knaithe / KnYuan
Also known as knaithe/KnYuan, knaithe, KnYuan, KnYuan Knaithe
Reports
3
First seen
Jul 31, 2026
Last seen
Aug 5, 2026
Motivation
Espionage, Financial
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Top ATT&CK techniques
T1190 Exploit Public-Facing Application ×3T1046 Network Service Discovery ×2T1078 Valid Accounts ×1T1592.004 Client Configurations ×1T1104 Proxy Execution ×1T1005 Data from Local System ×1T1018 Remote System Discovery ×1T1059 Command and Scripting Interpreter ×1T1059.001 PowerShell ×1T1087 Account Discovery ×1T1567 Exfiltration Over Web Service ×1T1592 Gather Victim Host Information ×1
Indicators
cve ×17domain ×1
Indicator values are available on Pro and via the API.