Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
Back to threat actors
Exploits CVEs in the wild

JADEPUFFER

Also known asJADEPUFFER
Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial
MITRE ATT&CK

Tradecraft

17 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

10 of 15 tactics26 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0001
Initial Access
1 technique
T1078
Valid Accounts
TA0002
Execution
3 techniques
T1053
Scheduled Task/Job
T1053.003
Cron
T1059
Command and Scripting Interpreter
T1059.006
Python
T1203
Exploitation for Client Execution
TA0003
Persistence
3 techniques
T1053
Scheduled Task/Job
T1053.003
Cron
T1078
Valid Accounts
T1136
Create Account
TA0004
Privilege Escalation
3 techniques
T1053
Scheduled Task/Job
T1053.003
Cron
T1078
Valid Accounts
T1611
Escape to Host
TA0005
Stealth
1 technique
T1078
Valid Accounts
TA0006
Credential Access
2 techniques
T1555
Credentials from Password Stores
T1649
Steal or Forge Authentication Certificates
TA0007
Discovery
4 techniques
T1046
Network Service Discovery
T1082
System Information Discovery
T1083
File and Directory Discovery
T1619
Cloud Storage Object Discovery
TA0008
Lateral Movement
1 technique
T1210
Exploitation of Remote Services
TA0009
Collection
1 technique
T1005
Data from Local System
TA0040
Impact
3 techniques
T1485
Data Destruction
T1486
Data Encrypted for Impact
T1491
Defacement
WEAPONIZED

Associated vulnerabilities

1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.

CVE-2021-29441Authentication Bypass in Nacos AuthFilter (User-Agent Backdoor)In the wildEvidence1

Captured payloads show the LLM attacking the Nacos service through multiple vectors simultaneously. That includes exploiting the auth-bypass family (CVE-2021-29441), forging a valid JWT using Nacos's well-known default signing key, and, with root database access, injecting a backdoor administrator directly into the Nacos backing database.

IOCS

Observables

4 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

4 IOCsView more in app

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Start free trial
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping17

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs1

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables4

Domains, IPs, and hashes tied to this actor, refreshed continuously.