Loading threat actor…
VAULT PANDA, also tracked as UNC6588, is a China-nexus threat actor known for rapidly operationalizing newly disclosed vulnerabilities in internet-facing applications. Confirmed targets include a telecommunications operator and an insurer based in Asia. Its operations involve exploitation for initial access, elevated database access, operating-system command execution, reconnaissance, credential harvesting, and attempted data exfiltration. In August 2026, VAULT PANDA exploited CVE-2026-72898, an unauthenticated SQL injection vulnerability in Metabase, less than one hour after a public exploit template became available. The actor obtained administrative access to Metabase and superuser access to its PostgreSQL backend, then abused PostgreSQL's privileged COPY TO PROGRAM functionality to execute operating-system commands. This functionality is associated with CVE-2019-9193 but is considered intended behavior by PostgreSQL maintainers. A Base64-encoded shell script collected system information and attempted DNS- and HTTP-based exfiltration. VAULT PANDA also incorporated React2Shell exploitation into active operations within 24 hours of its public disclosure. These attacks involved implants, remote access tools, reconnaissance utilities, and credential harvesting. Its activity demonstrates close monitoring of vulnerability disclosures and rapid integration of public exploits into operational attacks.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 CVEs Mallory has associated with this actor across public reporting. 3 of them are exploited in the wild (not necessarily by this actor).
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.