Loading threat actor…
CL-UNK-1068 is a previously undocumented Chinese threat actor assessed to have conducted a long-running cyberespionage campaign since at least 2020 against high-value organizations across South, Southeast, and East Asia. Reported targeting includes aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications entities, with tradecraft and victimology indicating a focus on critical infrastructure and state-related organizations. The actor operates across both Windows and Linux environments and uses a mixed toolkit of custom malware, modified open-source utilities, web shells, tunneling tools, and living-off-the-land techniques. Initial access has been associated with exploitation of internet-facing web servers and deployment of GodZilla and an AntSword variant as web shells. After establishing a foothold, the group uses those web shells for lateral movement to additional hosts and SQL servers, reconnaissance, privilege escalation, credential access, and data collection. Observed post-compromise behavior includes theft of web application configuration and related server files, browser history and bookmarks, office documents and spreadsheets, and database backup material. The actor has also used credential theft and memory-dumping tooling including Mimikatz, LsaRecorder, DumpItForLinux, the Volatility Framework, and a SQL Server Management Studio password export utility. For stealth, persistence, and payload execution, CL-UNK-1068 has used DLL side-loading through legitimate Python executables, modified Fast Reverse Proxy builds for command-and-control and firewall bypass, and in some cases the Xnote Linux backdoor. Additional tooling includes a custom Go-based scanner known as ScanPortPlus, as well as batch-script and custom reconnaissance workflows. The actor’s dominant objective is assessed as espionage, based on sustained targeting of Asian critical infrastructure and government-linked sectors and the emphasis on credential theft and sensitive data exfiltration. Some reporting notes that purely cybercriminal intent cannot be fully ruled out, but the strongest supported assessment is that CL-UNK-1068 is a Chinese cyberespionage cluster.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
32 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
18 malware families attributed to this actor across reporting.
13 additional families tracked in Mallory.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
PwnKit: CVE-2021-4034 Attackers deployed PwnKit, a self-contained exploit (CVE-2021-4034) to achieve local privilege escalation on Linux systems.
Custom Python EXE: CVE-2023-34048 ... This appears to be exploitation of CVE-2023-34048, a vulnerability in VMware vCenter Server that allows for remote code execution.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Chinese threat cluster targeting high-value organizations across Asia, using web shells for initial access and lateral movement into additional hosts and SQL servers.
Covert, multi-year intrusion campaign assessed as likely espionage-focused, exploiting misconfigured web servers to deploy webshells, conduct lateral movement, steal credentials, and exfiltrate sensitive data (e.g., browser history, spreadsheets, database backups) across Windows and Linux environments.
Previously undocumented China-linked activity cluster assessed as primarily conducting long-term cyber-espionage against high-value organizations in South/Southeast/East Asia. Operations include web server exploitation to deploy web shells, lateral movement, credential theft, and stealthy data exfiltration (e.g., Base64-encoding archives and printing via web shell output). Tooling spans Windows and Linux and mixes custom malware, modified open-source utilities, and LOLBIN usage.
Long-running cyberespionage activity cluster targeting critical infrastructure and government-linked sectors across Asia, using web server exploitation and web shells for initial access, then credential theft and data exfiltration across Windows and Linux.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.