Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · JACKPOT PANDA · Unknown · assessed origin China · misp-galaxy · refreshed 2026-10-06

JACKPOT PANDA

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2025-55182

Analyst brief

misp-galaxy

Jackpot Panda is a China-nexus state-sponsored APT primarily focused on cyber espionage against East and Southeast Asian entities, particularly in the online gambling sector and domestic security. They rapidly exploited CVE-2025-55182 using automated scanning, reconnaissance commands, and multi-vulnerability campaigns. Their activities have been linked to infrastructure associated with the exploitation of trojanized platforms and malware deployment, including SNOWLIGHT and VShell.

CVEs JACKPOT PANDA is cited as exploiting

1 on CISA KEV
  1. CVE-2025-55182KEV2026-10-17
    1. “Within hours of CVE-2025-55182 disclosure on December 3, 2025, Amazon Web Services observed exploitation attempts from infrastructure linked to Jackpot Panda.”

      cited as exploiting · source: blog.polyswarm.io ↗ · 2026-10-17

    2. “Within hours of the public disclosure of CVE-2025-55182 (React2Shell) on December 3, 2025, Amazon threat intelligence teams observed active exploitation attempts by multiple China state-nexus threat groups, including Earth Lamia and Jackpot Panda.”

      cited as exploiting · source: aws.amazon.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

3 sources
  1. 1.cloud.google.com/blog/topics/threat-intelligence/threat-actors-exploit-…
  2. 2.blog.polyswarm.io/multiple-threat-actors-leveraging-cve-2025-55182-react…
  3. 3.aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly…

Track JACKPOT PANDA on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.