File · CL-UNK-1068 · Unknown · assessed origin China · misp-galaxy · refreshed 2026-10-06
CL-UNK-1068
sigil · no ATT&CK coverage stated
What changed
ledger · newest first- —todaynew CVE1 new CVE: CVE-2023-34048
Analyst brief
misp-galaxyCL-UNK-1068 is a Chinese threat actor that has targeted critical infrastructure in Asia, primarily focusing on cyberespionage. They utilize cross-platform tools, including the Xnote Linux backdoor and the GodZilla web shell, to maintain a persistent presence and execute credential theft. Their TTPs involve DLL side-loading, the use of custom malware, and batch scripts to bypass security measures. The group has demonstrated a capability for data exfiltration from SQL servers and has employed tools like DumpIt and Volatility for memory analysis.
CVEs CL-UNK-1068 is cited as exploiting
none on KEV- CVE-2023-340482026-10-17
“This appears to be exploitation of CVE-2023-34048 , a vulnerability in VMware vCenter Server that allows for remote code execution.”
cited as exploiting · named nearby · source: unit42.paloaltonetworks.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Take it with you
keyless · no signupReferences
1 sourceTrack CL-UNK-1068 on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.