UNC215 is a Chinese cyber espionage group that Mandiant began tracking in early 2019, although its operations are believed to stem from a broader Chinese espionage campaign dating back to 2014. The group's primary motivation is information theft and espionage, focusing on obtaining sensitive information and intellectual property aligned with Beijing's financial, diplomatic, and strategic interests. What distinguishes UNC215 is its sophisticated use of false flag operations, meticulously crafting deceptions to masquerade as Iranian actors by employing Farsi strings, utilizing Iranian web shells like SEASHARPEE, and incorporating '/Iran/' filepaths in their operations to mislead attribution. The group has also demonstrated an adaptive approach to its tradecraft, continuously evolving its tactics, techniques, and procedures to hinder detection and attribution, including leveraging trusted relationships for lateral movement. While UNC215 is distinct, it has been linked with low confidence

Aliases del actor

APT UNC215

Actores similares

apt-unc215actor · 1apt-45actor · 2apt-c-27actor · 2apt-c-01actor · 2apt-c-12actor · 1apt-18actor · 1apt-1877teamactor · 1apt-27actor · 1apt-30actor · 1apt-38actor · 1