UNC1088
RAVINE CASTLE
UNC1088 is a China-nexus threat cluster tracked by Mandiant, renamed RAVINE CASTLE under Google Threat Intelligence's updated naming system.
origin (suspected)
China
source: misp-galaxy1 refs →
UNC1088· China
UNC1088 is a China-nexus cyber espionage group known for network reconnaissance and data theft.
Analyst brief
UNC1088 (also tracked as RAVINE CASTLE) is a China-nexus threat cluster with limited public details, monitored by Mandiant. The targeting scope of this actor is not specified in the provided data, but its activity is assessed to focus on cyber espionage. Defenders should prioritize network monitoring for anomalous reconnaissance and data exfiltration behaviors, as specific TTPs and tools are not disclosed.
unknown
FAQ2
Who is UNC1088 and what is its alias?
UNC1088 is a China-nexus threat actor tracked by Mandiant, now renamed RAVINE CASTLE under Google Threat Intelligence's updated naming system.
What is the primary objective of UNC1088's activity?
Based on the provided information, the activity of UNC1088 is assessed to focus on cyber espionage.
See also6
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.