CL-UNK-1068
CL-UNK-1068 is a previously undocumented threat cluster tracked by Palo Alto Networks Unit 42 and assessed with high confidence to be a Chinese threat actor. Unit 42 reports the group has targeted high-value organizations across South, Southeast, and East Asia since at least 2020, including aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications sectors. Unit 42 assesses with moderate-to-high confidence that the campaign’s primary objective is cyber espionage, while noting cybercriminal intent cannot be fully ruled out. Observed tradecraft includes exploitation of web servers for initial access and deployment of web shells, including GodZilla and a variation of AntSword, followed by lateral movement to additional hosts and SQL servers. The actor operates across both Windows and Linux environments and uses a mix of custom malware, modified open-source utilities, and living-off-the-land binaries. Reported tooling includes modified Fast Reverse Proxy (FRP) for persistent access and firewall bypass, the Xnote Linux backdoor, a custom Go-based scanner called ScanPortPlus, and DLL side-loading via legitimate python.exe or pythonw.exe with a malicious loader DLL. Post-compromise activity includes reconnaissance, privilege escalation, credential theft, and exfiltration of sensitive data. Unit 42 observed use of Mimikatz, LsaRecorder, DumpIt or DumpItForLinux with the Volatility Framework, the SQL Server Management Studio Password Export Tool, and in some reporting usql. The actor stole browser history and bookmarks, XLSX and CSV files, MSSQL .bak database backups, and web application files from c:\inetpub\wwwroot, including web.config, appsettings.json, and .aspx, .asmx, .asax, and .dll files. In observed cases, stolen data was archived with WinRAR, Base64-encoded with certutil -encode, and printed through the web shell using the type command to exfiltrate data without direct file transfer. The content does not provide any confirmed aliases or sub-groups beyond the tracking name CL-UNK-1068.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Transportation
- Energy
- Software & Services
- Telecommunication Services
- Health Care Equipment & Services
Where they're from
Attributed origin per open-source reporting.
- CN
Tradecraft
32 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
18 malware families attributed to this actor across reporting.
13 additional families tracked in Mallory.
Associated vulnerabilities
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
PwnKit: CVE-2021-4034 Attackers deployed PwnKit, a self-contained exploit (CVE-2021-4034) to achieve local privilege escalation on Linux systems.
Custom Python EXE: CVE-2023-34048 ... This appears to be exploitation of CVE-2023-34048, a vulnerability in VMware vCenter Server that allows for remote code execution.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Chinese threat cluster targeting high-value organizations across Asia, using web shells for initial access and lateral movement into additional hosts and SQL servers.
Covert, multi-year intrusion campaign assessed as likely espionage-focused, exploiting misconfigured web servers to deploy webshells, conduct lateral movement, steal credentials, and exfiltrate sensitive data (e.g., browser history, spreadsheets, database backups) across Windows and Linux environments.
Previously undocumented China-linked activity cluster assessed as primarily conducting long-term cyber-espionage against high-value organizations in South/Southeast/East Asia. Operations include web server exploitation to deploy web shells, lateral movement, credential theft, and stealthy data exfiltration (e.g., Base64-encoding archives and printing via web shell output). Tooling spans Windows and Linux and mixes custom malware, modified open-source utilities, and LOLBIN usage.
Long-running cyberespionage activity cluster targeting critical infrastructure and government-linked sectors across Asia, using web server exploitation and web shells for initial access, then credential theft and data exfiltration across Windows and Linux.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.