From b72868b6cd2cde73c0134f99c9190b782728d88c Mon Sep 17 00:00:00 2001 From: Mathieu Beligon Date: Wed, 6 Dec 2023 17:42:33 -0800 Subject: [PATCH] [threat-actors] Add UNC2717 --- clusters/threat-actor.json | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 4a31f36..4ec3dc0 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -13639,6 +13639,18 @@ }, "uuid": "5e32baed-f4b5-4149-8540-7515ad8c4dc0", "value": "Daixin Team" + }, + { + "description": "UNC2717 is a threat actor that engages in espionage activities aligned with Chinese government priorities. They demonstrate advanced tradecraft and take measures to avoid detection, making it challenging for network defenders to identify their tools and intrusion methods. UNC2717, along with other Chinese APT actors, has been observed stealing credentials, email communications, and intellectual property. They have targeted global government agencies using malware such as HARDPULSE, QUIETPULSE, and PULSEJUMP.", + "meta": { + "country": "CN", + "refs": [ + "https://www.fireeye.com/blog/threat-research/2021/05/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices.html", + "http://internal-www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html" + ] + }, + "uuid": "f1d90b54-4821-41ff-8e07-ac650e0454b7", + "value": "UNC2717" } ], "version": 295