UNC3524

UNC3524 is a stealth-focused cyber espionage threat actor tracked for long-duration intrusions centered on mailbox access and email collection. The actor has demonstrated strong operational security, including persistence from victim blind spots such as uncommon Linux systems and network appliances that are poorly covered by endpoint security tooling, enabling dwell times of up to roughly 18 months in some environments. UNC3524 has used customized tooling for lateral movement, including a modified version of Impacket WMIEXEC designed to evade filename-based detections, and has leveraged native Windows utilities to collect registry hives for offline extraction of LSA secrets. After obtaining privileged credentials, the actor accessed victim mail environments through Exchange Web Services against both on-premises Microsoft Exchange and Microsoft 365 Exchange Online. Mailbox targeting has focused on executive leadership and personnel involved in corporate development, mergers and acquisitions, and IT security, indicating an intelligence-collection objective and an interest in monitoring defensive awareness. Within Exchange environments, UNC3524 has enumerated mailbox folders and metadata, queried for newly created messages since prior access, and retrieved full MIME content including message bodies and attachments. The actor has authenticated using compromised user credentials as well as higher-privilege mechanisms such as impersonation-capable accounts and service principal credentials. UNC3524 has also used the QUIETEXIT tunneler to minimize tool deployment and support covert post-compromise operations. The actor’s tradecraft and targeting are consistent with espionage activity. Technique overlap has been noted with multiple Russia-linked espionage clusters, including similarities to activity associated with APT29 and APT28, but no conclusive attribution to an already tracked group is established here at high confidence.