Loading threat actor…
UNC6512 is a newly emergent threat operation linked to exploitation of the Windows Server Update Service vulnerability CVE-2025-59287. Following initial access via the WSUS flaw, the actor has been observed conducting reconnaissance on compromised hosts and related environments and exfiltrating data. Reported victim organizations affected in the broader exploitation wave included technology firms, manufacturers, healthcare organizations, and universities, with most known victims located in the United States. Available reporting directly supports UNC6512 activity centered on initial access through vulnerability exploitation, post-compromise reconnaissance, and data theft. Attribution to a specific nation state or criminal ecosystem is not currently available.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Newly identified intrusion activity cluster leveraging a critical WSUS untrusted deserialization vulnerability (CVE-2025-59287) to compromise vulnerable WSUS instances for reconnaissance and data exfiltration; activity appears consistent with an initial testing/reconnaissance phase preceding follow-on intrusion opportunities.
Exploitation of the critical Windows Server Update Service vulnerability CVE-2025-59287 to gain initial access, conduct reconnaissance on compromised hosts and related environments, and exfiltrate data.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.