JACKPOT PANDA
| Actor Type | Commercial Provider, Nation State |
|---|---|
| Attributed to Nation | China |
| Associated Threat Actor | i-SOON |
JACKPOT PANDA is a cyber intrusion set tracked by CrowdStrike who state that the actor has been active since at least May 2020 and likely operates in support of 'People’s Republic of China (PRC’s) intelligence collection priorities related to domestic security and corruption.' The group has also been reported targeting Chinese-speaking gambling communities.
According to CrowdStrike reporting, in 2023 JACKPOT PANDA was observed compromising supply chains to exploit trusted relationships to downstream organizations. In particular, the 2024 CrowdStrike Global Threat Report details how JACKPOT PANDA was identified utilizing LiveHelp100 (from Comm100) to launch malicious tooling (QuestDownloader) as part of an attack.
Reporting from a document leak at Chinese cyber security company 'i-SOON' indicated an overlap between that company and infrastructure attributed to JACKPOT PANDA. The link is based on an IP address identified by TrendMicro as being linked to the Comm100 compromise. This suggests that the group may be a commercial provider carrying out some activities on behalf of Chinese government organizations.
Cyber Threat Graph Context
Explore how this Intrusion Set relates to the wider threat graph