UNC2814Threat actor
- dark castle
UNC2814 is a suspected PRC-nexus cyber espionage group that has targeted telecommunications providers and government entities globally since at least 2017. The group employs the GRIDTIDE backdoor to blend malicious traffic with legitimate cloud API activity and utilizes living-off-the-land techniques, including SSH lateral movement and the creation of malicious systemd services.From MISP Galaxy
Last reported 27 days ago, by CERT-EU2 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1195Supply Chain Compromise
“We noted several global China-linked campaigns, such as APT group Lotus Blossom's Notepad++ supply-chain compromise and UNC2814’s campaign targeting telecoms and government entities worldwide.”
- T1684Social Engineering
“The infostealer, linked to the GrayBravo threat actor, is spreading through social engineering lures such as fake CAPTCHAs.”
- T1552.004Private Keys
“…t 341 malicious “skills” published to ClawHub and GitHub that deliver info-stealing malware targeting cryptocurrency API keys, wallet private keys, SSH credentials and browser passwords.”
- T1657Financial Theft
“…ack spoofed Ukrainian judicial domains to target a senior legal advisor, aiming to gain remote access for intelligence gathering or financial theft.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Cyber Brief 26-03 - February 2026“We noted several global China-linked campaigns, such as APT group Lotus Blossom's Notepad++ supply-chain compromise and UNC2814’s campaign targeting telecoms and government entities worldwide.”
-
Cyber Brief 26-04 - March 2026“China-linked UNC2814 cyberespionage operation against Costa Rican Electricity Institute”
Thanks — we review every report.