Unit 8200Threat actor
- duqu group
Last reported 27 days ago, by CERT-EU2 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1684Social Engineering
“This method significantly reduces the risk of detection and failure, as it does not rely on preemptive social engineering.”
- T1195Supply Chain Compromise
“…ers to target government and defence organisations in Asia and Poland, while another China-linked threat actor enacted a global supply-chain compromise leveraging Daemon Tools installers distributed from the software's legitimate site.”
- T1213.003Code Repositories
“… 19, GitHub began investigating unauthorised access to internal repositories, with TeamPCP claiming theft of roughly 4.000 private code repositories and seeking to sell the data.”
- T1219Remote Access Tools
“They hosted company laptops in the US, installed remote access tools, and helped overseas operatives pose as US-based employees, generating over 1.2 million US dollars for North Korea and affecting nearly 70 US firms.”
- T1485Data Destruction
“…ing an agreement with the threat actor, the group reportedly returned the data to Instructure, and received digital confirmation of data destruction.”
- T1505.003Web Shell
“UAT-8616 exploited Cisco Catalyst SD-WAN vulnerabilities to gain admin access and deploy web shells”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Cyber Brief 26-06 - May 2026“The investigation followed revelations that Unit 8200 used Microsoft Azure to store and analyse millions of intercepted Palestinian phone calls, prompting concerns over possible ethics violations and leading Microsoft to revoke the unit’s access to certain cloud and AI services.”
-
Predators for Hire: Commercial Surveillance Vendors Overview“…ational press articles, the sophistication of the 0-click technique was likely enabled by the recruitment by CSVs of former members of Unit 8200, a division of the Israeli Military Intelligence Corps (AMAN), regarded as one of the foremost technical and cyber-offensive intelligen…”
Indicators in its reports
named in the reports above- gov[.]ukin 1 report
- surveillancewatch[.]ioin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.