Loading threat actor…
UNC6229 is a financially motivated Vietnam-linked cybercriminal threat cluster associated with social-engineering campaigns that use fake job and career opportunities to compromise victims and steal access to online business assets. The group has been linked to the evolution and distribution of the Noodlophile stealer and related multi-stage malware chains, and has targeted job seekers, students, digital marketers, and advertising professionals through fraudulent recruitment lures, including fake application forms, skill assessments, phishing links, and malicious archive attachments. UNC6229’s operations are centered on credential theft and remote access enablement. Reported campaigns have sought to hijack or steal corporate and advertising-account access, particularly in digital advertising and marketing contexts. Delivery chains have included multi-stage stealers and remote access trojans, with DLL sideloading used for execution. Malware associated with these campaigns has used Telegram-based command-and-control or exfiltration workflows and has incorporated anti-analysis and reverse-engineering resistance such as dynamic API resolution via hashing, encrypted command components, string obfuscation, and tamper-detection logic that terminates execution when modification or debugging is detected. The cluster is publicly tracked as UNC6229 and has been described as operating out of Vietnam. Its activity is consistent with cybercrime rather than state-directed espionage, with a primary objective of monetizing stolen credentials and compromised business accounts.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
10 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Credential theft/espionage-style activity using social engineering (fake job postings) to deliver multi-stage information stealers and RATs, leveraging DLL sideloading and adding anti-analysis/obfuscation (djb2 hashing, XOR encoding).
Vietnam-linked cybercriminal activity cluster referenced in connection with info-stealer campaigns (mentioned alongside Noodlophile/PXA Stealer).
Linked to campaigns delivering the Noodlophile information stealer via fake job postings and phishing lures (employment application forms/skill tests), using multi-stage stealers and RATs delivered through DLL sideloading; uses Telegram bots for exfiltration/C2 and employs anti-analysis/obfuscation (file bloat to crash Python disassembly tooling, dynamic API resolution via djb2 hashing, signature self-check, RC4/XOR).
A campaign attributed to UNC6229 using fake job/career lures to compromise and hack advertising accounts.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.