unc215

UNC215 is a Chinese cyber-espionage cluster active since at least 2014 and publicly documented for sustained operations against Israeli organizations beginning in early 2019. The actor has been linked with low confidence to APT27, also known as Emissary Panda and Iron Tiger, based on overlaps in targeting and high-level tradecraft, but the relationship is not confirmed. UNC215 has targeted government institutions, information technology providers, and telecommunications entities, with operations assessed to align with Chinese strategic intelligence requirements, including interests connected to Israel and Belt and Road Initiative-related activity. UNC215 has used exploitation of internet-facing enterprise applications for initial access, notably Microsoft SharePoint via CVE-2019-0604, followed by deployment of web shells and custom malware. Malware associated with the cluster includes FOCUSFJORD, typically used in earlier intrusion stages for persistence and command-and-control, and HYPERBRO, used for expanded collection including keylogging and screen capture. The group has also used utilities to reconfigure or remove malware artifacts and has repeatedly modified tooling over time. Post-compromise activity includes credential harvesting, extensive internal reconnaissance using native Windows commands and ADFind, identification of key systems such as domain controllers and Exchange or Outlook Web Access infrastructure, and lateral movement across victim environments. UNC215 has also used scanning tools, including both public utilities and a non-public scanner referred to as WHEATSCAN. In at least one operation, the actor leveraged stolen credentials and remote access through a trusted third party to reach an Israeli government network. Operational security and defense evasion are notable features of UNC215 tradecraft. The actor has deleted tools and residual artifacts, stored encrypted configuration data in the Windows registry, proxied command-and-control traffic through victim networks, and adjusted tooling to reduce suspicious outbound communications. Campaigns have also included false-flag elements, such as foreign-language artifacts and use of an Iranian-associated web shell after its code became publicly available. Despite these measures, UNC215 has shown imperfect compartmentalization through reuse of malware components and infrastructure across victims.