GINC-APT-0603 · State

UNC2717

Category
State · Attributed to a state or working for one.
Origin
China(high confidence)
Sources
4 sources carry it
Identifier
GINC-APT-0603 · unc2717

What it is

UNC2717 is a threat actor that engages in espionage activities aligned with Chinese government priorities. They demonstrate advanced tradecraft and take measures to avoid detection, making it challenging for network defenders to identify their tools and intrusion methods. UNC2717, along with other Chinese APT actors, has been observed stealing credentials, email communications, and intellectual property. They have targeted global government agencies using malware such as HARDPULSE, QUIETPULSE, and PULSEJUMP.

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de