UNG0002 is a technically skilled group conducting cyber espionage against strategic sectors across South and Southeast Asia.
Analyst brief
UNG0002 is a technically adept threat group, possibly originating from South or Southeast Asia, conducting large-scale cyber espionage. The group targets strategic sectors including defense, energy infrastructure, and healthcare in China, Hong Kong, and Pakistan. Their key TTPs involve phishing emails with LNK shortcuts and VBScript files, leveraging Cobalt Strike and Metasploit, along with Shadow RAT malware employing DLL Sideloading for remote command execution. Defenders should focus on monitoring suspicious email attachments, unusual script execution, and network traffic for C2 beaconing.
UNG0002
unknown
UNG0002 is a technically adept APT conducting large-scale cyber espionage campaigns targeting strategic sectors in China, Hong Kong, and Pakistan, including defense, energy infrastructure, and healthcare. The group employs LNK shortcuts, VBScript files, and tools like Cobalt Strike and Metasploit, utilizing phishing emails with deceptive documents to lure victims. Their malware, such as Shadow RAT, leverages DLL Sideloading and supports remote command execution, making detection challenging. Analysts suggest that UNG0002 may originate from South or Southeast Asia, highlighting their resilience and adaptability in cyber operations.