UAT-8616Threat actor
UAT-8616 is a highly sophisticated cyber threat actor attributed by Cisco Talos, with evidence of activity dating back to at least 2023. They have been observed exploiting CVE-2026-20127 in the wild and previously exploited CVE-2022-20775 by escalating to root user access through a software version downgrade.From MISP Galaxy
Last reported 27 days ago, by CERT-EU1 report
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1195Supply Chain Compromise
“…ers to target government and defence organisations in Asia and Poland, while another China-linked threat actor enacted a global supply-chain compromise leveraging Daemon Tools installers distributed from the software's legitimate site.”
- T1213.003Code Repositories
“… 19, GitHub began investigating unauthorised access to internal repositories, with TeamPCP claiming theft of roughly 4.000 private code repositories and seeking to sell the data.”
- T1219Remote Access Tools
“They hosted company laptops in the US, installed remote access tools, and helped overseas operatives pose as US-based employees, generating over 1.2 million US dollars for North Korea and affecting nearly 70 US firms.”
- T1485Data Destruction
“…ing an agreement with the threat actor, the group reportedly returned the data to Instructure, and received digital confirmation of data destruction.”
- T1505.003Web Shell
“UAT-8616 exploited Cisco Catalyst SD-WAN vulnerabilities to gain admin access and deploy web shells”
- T1684Social Engineering
“Authorities cited phishing and social-engineering attacks targeting public officials, including campaigns impersonating Signal support staff to hijack accounts, amid growing concerns over foreign-linked cyber threats and digital sovereignty.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Cyber Brief 26-06 - May 2026“UAT-8616 exploited Cisco Catalyst SD-WAN vulnerabilities to gain admin access and deploy web shells”
Thanks — we review every report.