unk_coltcentury
UNK_ColtCentury is a China-aligned threat actor tracked by Proofpoint that overlaps with TAG-100 and Storm-2077. In October 2024, the group targeted legal personnel at Taiwanese semiconductor organizations using benign conversation-starter or cold emails intended to build trust. Proofpoint assessed that this activity was likely an attempt to ultimately deliver the SparkRAT backdoor. The targeting fits a broader pattern of China-aligned espionage activity against Taiwan’s semiconductor ecosystem, including related legal personnel connected to the industry.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- semiconductors
- legal
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
UNK_ColtCentury is a Chinese APT that targeted legal personnel at Taiwanese semiconductor companies with phishing emails, likely leading to SparkRAT backdoor infections.
Engaging in trust-building email campaigns targeting legal personnel in Taiwanese semiconductor organizations to deliver Spark RAT.
China-aligned cluster observed sending benign 'conversation starter' emails to legal personnel at a Taiwanese semiconductor organization, assessed as pretexting to enable follow-on malware deployment (likely SparkRAT).
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.