Loading threat actor…
UNC3569 is a China-nexus threat actor operating largely from within the Chinese cybercriminal and contractor-for-hire ecosystem and assessed to conduct primarily espionage-oriented intrusions. The group has targeted organizations worldwide, with activity concentrated in East and Southeast Asia and additional operations affecting the United States and other regions. Reported victim sectors include government, education, technology, finance, media, telecommunications, airlines, heavy industry, energy, and the gambling industry. UNC3569 is notable for systematic exploitation of known vulnerabilities in internet-facing enterprise software to obtain initial access. Observed targets have included products from Apache, Microsoft, IBM, VMware, Oracle, Aspera Faspex, Microsoft Exchange, and Oracle Web Applications Desktop Integrator. After compromise, the actor has used reconnaissance tooling and port-forwarding utilities, established footholds with Cobalt Strike BEACON, and deployed a set of backdoors centered on DRAFTGRAPH, CROSSWALK, and the custom GRAYRABBIT malware family. Additional loaders and evasion components associated with the actor include SIDESTEP and multiple RABBIT-prefixed tools. UNC3569 has also been linked to cloud-hosted and supply-chain operations, including abuse of trojanized software and legitimate platforms such as GitHub and OneDrive for payload delivery and command-and-control. The actor demonstrates broad post-compromise capability, including lateral movement, credential and browser-data collection, screenshot capture, and stealthy payload execution. Public reporting also links UNC3569-associated activity to use of commercial Chinese remote-control software, public offensive tooling, and malware delivery chains designed to reduce antivirus visibility. Infrastructure patterns attributed to the group include spoofed branding themes and segmented subdomain usage by malware family. UNC3569 has further been linked through tooling and infrastructure overlaps to other PRC-nexus clusters including UNC251 and UNC3246, and some reporting notes a possible relationship with the Sichuan-based contractor i-SOON. Separate attribution work has connected PeckBirdy-enabled activity tracked as SHADOW-VOID-044 to UNC3569 with moderate-to-high confidence based on GRAYRABBIT overlap, shared infrastructure characteristics, and overlapping targeting of the gambling sector.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
24 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
33 malware families attributed to this actor across reporting.
28 additional families tracked in Mallory.
5 CVEs this actor has used in observed campaigns. 5 of them exploited in the wild.
Delivered scripts observed include CVE-2020-16040 exploitation for Chrome, social engineering pop-ups, Electron JS backdoor delivery, and TCP reverse shell establishment.
Download multiple ProxyShell exploit tools for testing: Proxyshell-auto ... Exploit tool based on CVE-2021-34473, CVE-2021-31206, CVE-2021-34523, CVE-2021-31207 ... proxyshell ... based on the Microsoft Exchange CVE-2021-34473, CVE-2021-34523, CVE-2021-31207.
Since 2021, UNC3569 has exploited popular n-day CVEs in widely used software, such as CVE-2021-44228 and CVE‑2022-21587, to gain access to target organizations.
Since 2021, UNC3569 has exploited popular n-day CVEs in widely used software, such as CVE-2021-44228 and CVE‑2022-21587, to gain access to target organizations.
In February 2023, UNC3569 targeted a US media and entertainment company, exploiting CVE-2022-47986, which allowed the attackers to execute arbitrary commands on the Aspera Faspex server.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Assessed as linked (moderate-to-high confidence) to the SHADOW-VOID-044 campaign leveraging PeckBirdy and associated infrastructure; described as targeting the gambling sector.
Named activity cluster referenced due to infrastructure overlap (a C2 domain) with Shadow-Void-044; no additional operational details provided in the content.
China-backed cluster associated (in this reporting) with use of the GrayRabbit backdoor; mentioned in the context of the Shadow-Earth-045 campaign toolset.
China-linked cluster referenced as a prior user of the GRAYRABBIT backdoor (with DRAFTGRAPH and Crosswalk) following exploitation of N-day vulnerabilities; mentioned as a possible linkage signal to SHADOW-VOID-044 infrastructure.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.