Threat Intelligence / Actor / Unattributed (Chinese Nexus)

Unattributed (Chinese Nexus)

Nation: China · 1 tracked threat(s) · Categories: SUPPLY_CHAIN

Also known as: NginRAT operators, CronRAT operators

Tracked threats

NginRAT/CronRAT Server-Side Magecart Campaign — NGINX LD_PRELOAD Process Parasitism, Impossible Cron Date Persistence (February 31st), Fileless Payment Card Skimming, Dropbear SSH C2 Impersonation, Chinese-Nexus eCommerce Targeting — HIGH

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence