Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

UNG0002, an espionage-focused threat group, has been conducting campaigns across Asian jurisdictions including China, Hong Kong, and Pakistan. The group employs sophisticated multi-stage attacks using LNK files, VBScript, and custom RAT implants. Their operations span two major campaigns: Operation Cobalt Whisper and Operation AmberMist, targeting various sectors such as defense, aviation, gaming, and academia. UNG0002 utilizes social engineering techniques like ClickFix and abuses DLL sideloading to evade detection. The group demonstrates high adaptability, evolving from using Cobalt Strike to developing custom implants like Shadow RAT and INET RAT. Attribution challenges persist, but the group is assessed to originate from South-East Asia with a focus on espionage activities.

UNG0002 (Unknown Group 0002) is an espionage-focused threat actor group conducting sophisticated multi-stage cyber campaigns primarily across Asian jurisdictions such as China, Hong Kong, and Pakistan. The group employs advanced social engineering tactics and technical methods to infiltrate target networks. Their attack vectors include the use of malicious LNK shortcut files and VBScript to initiate payload execution. They leverage DLL sideloading techniques, abusing legitimate Windows functionality to load malicious DLLs stealthily, thereby evading traditional detection mechanisms. UNG0002 has evolved from using publicly available tools like Cobalt Strike to deploying custom remote access trojans (RATs) such as Shadow RAT and INET RAT, indicating a high level of technical capability and adaptability. The campaigns, named Operation Cobalt Whisper and Operation AmberMist, target diverse sectors including defense, aviation, gaming, and academia, reflecting a broad espionage interest. The group also uses social engineering frameworks like ClickFix to trick users into executing malicious content. Despite attribution challenges, intelligence assesses the group’s origin as South-East Asia, with a clear focus on espionage activities. Indicators of compromise include numerous file hashes and a suspicious domain (moma.islamabadpk.site). The group’s tactics, techniques, and procedures (TTPs) align with multiple MITRE ATT&CK techniques such as T1566.001 (Spearphishing), T1574.001 (DLL Side-loading), and T1059 (Command and Scripting Interpreter), among others. No known exploits in the wild or CVEs are associated with this campaign, but the threat remains active and evolving.

Detailed information about UNG0002 (Unknown Group 0002): Espionage Campaigns Uncovered. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'custom malware'

Filter Threats

Threats Tagged 'custom malware'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility