Attribution
Chinese state-nexus espionage cluster (moderate confidence). Mandiant assessed with medium confidence that UNC215 is a Chinese espionage operation; the 'UNC' prefix denotes an uncategorized/uncertain-attribution cluster not yet promoted to a named APT. Some tooling overlaps (e.g., HYPERBRO) are shared across multiple Chinese groups, complicating precise clustering.
Motivation
Espionage / intelligence collection (state-directed strategic and geopolitical intelligence gathering).
Attribution confidence
medium
Sectors
Government, IT service providers, telecom, defense
Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Israel (Government, IT service providers, telecom sectors).
What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.
No open hunts or recent alerts tracked against this actor right now.