ctrlINT What the industry said about every indicator, with the quote

UTA0388Threat actor

UTA0388 is a China-aligned APT known for spear-phishing campaigns targeting organizations in North America, Asia, and Europe, primarily to deliver a Go-based implant called GOVERSHELL. The group employs "rapport-building phishing" tactics, engaging targets in benign conversations before sending malicious links, and has been linked to the use of Large Language Models for crafting phishing emails…From MISP Galaxy

Last reported 12 months ago, by Volexity1 report

Suspected originChinaMISP Galaxy

ATT&CK techniques

1 technique · each with the sentence it comes from
  1. T1053.005Scheduled Task

    “All variants observed by Volexity make use of a scheduled task for persistence and provide the operator the ability to execute arbitrary commands on the target’s device.”

    VolexityVendor

What the reports say

1 report, newest first · the exact sentence from each

  1. “Volexity tracks the threat actor behind these campaigns under the alias UTA0388 and assesses with a high degree of confidence that this is a China-aligned threat actor.”

    VolexityVendor
    APT Meets GPT: Targeted Operations with Untamed LLMs

Indicators in its reports

named in the reports above
Copy these 12 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with UTA0388 here?
No account needed. We do not store your IP address.