🇨🇳
UTA0178
APT Group
Information theft and espionage
10 zero-day CVEs
ETDA ✓
Also Known As 2 names
Red Dev 61
UNC5221
Target Countries 2
Countries highlighted in red
United Kingdom
United States
Details
Origin
🇨🇳 CN
Last Updated
13 Jan 2024
MITRE ATT&CK 87
T1001
T1003 - OS Credential Dumping
T1005 - Data from Local System
T1014 - Rootkit
T1016 - System Network Configuration Discovery
T1021 - Remote Services
T1027 - Obfuscated Files or Information
T1027.002 - Software Packing
T1029 - Scheduled Transfer
T1033 - System Owner/User Discovery
T1036 - Masquerading
T1041 - Exfiltration Over C2 Channel
T1046 - Network Service Scanning
T1049 - System Network Connections Discovery
T1053 - Scheduled Task/Job
T1055 - Process Injection
T1056 - Input Capture
T1059 - Command and Scripting Interpreter
T1059.001
T1059.004 - Unix Shell
T1068 - Exploitation for Privilege Escalation
T1070 - Indicator Removal on Host
T1070.002 - Clear Linux or Mac System Logs
T1070.004 - File Deletion
T1071 - Application Layer Protocol
T1071.001 - Web Protocols
T1071.004 - DNS
T1078 - Valid Accounts
T1082 - System Information Discovery
T1083 - File and Directory Discovery
T1087 - Account Discovery
T1090 - Proxy
T1090.003 - Multi-hop Proxy
T1095 - Non-Application Layer Protocol
T1098 - Account Manipulation
T1102 - Web Service
T1105 - Ingress Tool Transfer
T1106 - Native API
T1112 - Modify Registry
T1114 - Email Collection
T1124 - System Time Discovery
T1132 - Data Encoding
T1133 - External Remote Services
T1134
T1135 - Network Share Discovery
T1140 - Deobfuscate/Decode Files or Information
T1189 - Drive-by Compromise
T1190 - Exploit Public-Facing Application
T1195
T1199 - Trusted Relationship
T1204.002 - Malicious File
T1205 - Traffic Signaling
T1213 - Data from Information Repositories
T1486
T1490
T1496
T1497 - Virtualization/Sandbox Evasion
T1505
T1518
T1534 - Internal Spearphishing
T1543 - Create or Modify System Process
T1543.002 - Systemd Service
T1546 - Event Triggered Execution
T1548 - Abuse Elevation Control Mechanism
T1550 - Use Alternate Authentication Material
T1552.001 - Credentials In Files
T1553 - Subvert Trust Controls
T1553.004 - Install Root Certificate
T1556 - Modify Authentication Process
T1560 - Archive Collected Data
T1562 - Impair Defenses
T1562.002 - Disable Windows Event Logging
T1566 - Phishing
T1567
T1571 - Non-Standard Port
T1572 - Protocol Tunneling
T1573 - Encrypted Channel
T1574
T1574.006 - Dynamic Linker Hijacking
T1583
T1588
T1588.001
T1592
T1595
T1598
T1600
T1610