apt

UNC215

dormant · last signal 3y agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

Attribution

Chinese state-nexus espionage cluster (moderate confidence). Mandiant assessed with medium confidence that UNC215 is a Chinese espionage operation; the 'UNC' prefix denotes an uncategorized/uncertain-attribution cluster not yet promoted to a named APT. Some tooling overlaps (e.g., HYPERBRO) are shared across multiple Chinese groups, complicating precise clustering.

Origin

China

First seen

2019-01

Last active

2020

Motivation

Espionage / intelligence collection (state-directed strategic and geopolitical intelligence gathering).

Attribution confidence

medium

MENA targeting

Israel

Sectors

Government, IT service providers, telecom, defense

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Israel (Government, IT service providers, telecom sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Nemesis KittenactorTechnique overlap
BianLianactorTechnique overlap
WarlockactorTechnique overlap
MontiactorTechnique overlap
Agrius (Agonizing Serpens / BlackShadow)actorTechnique overlap
RansomHubactorTechnique overlap
BladedFelineactorTechnique overlap
UNC1860actorTechnique overlap
APT39 / Chafer

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against UNC215's techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

9 / 14

Mean robustness (of covered)

2.1

Useful?

Uses

Trusted RelationshiptechniqueATT&CK mapping
Registry Run Keys / Startup FoldertechniqueATT&CK mapping
Modify RegistrytechniqueATT&CK mapping
DLLtechniqueATT&CK mapping
Web ShelltechniqueATT&CK mapping
Internal ProxytechniqueATT&CK mapping
Exploit Public-Facing ApplicationtechniqueATT&CK mapping
MasqueradingtechniqueATT&CK mapping
LSASS MemorytechniqueATT&CK mapping
Account DiscoverytechniqueATT&CK mapping
Disable or Modify ToolstechniqueATT&CK mapping
File DeletiontechniqueATT&CK mapping
Network Service DiscoverytechniqueATT&CK mapping
Remote Desktop ProtocoltechniqueATT&CK mapping