UAT-11823
MITRE G0034
Reports
3
First seen
Sep 9, 2026
Last seen
Oct 13, 2026
Motivation
Espionage
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Sectors
Top ATT&CK techniques
T1078 Valid Accounts ×3T1505.003 Web Shell ×3T1486 Data Encrypted for Impact ×3T1190 Exploit Public-Facing Application ×3T1003 OS Credential Dumping ×2T1021.002 SMB/Windows Admin Shares ×2T1021.001 Remote Services: Remote Desktop Protocol ×2T1005 Data from Local System ×1T1059 Command and Scripting Interpreter ×1T1059.004 Unix Shell ×1T1219 Remote Access Software ×1T1083 File and Directory Discovery ×1
Indicators
cve ×29ip_v4 ×5hash_sha256 ×3domain ×2filename ×2
Indicator values are available on Pro and via the API.
Associated CVEs
CVE-2026-20316 (exploited)CVE-2026-20079 (exploited)CVE-2019-0708 (exploited)CVE-2020-1938 (exploited)CVE-2021-29441 (exploited)CVE-2021-38003 (exploited)CVE-2021-43798 (exploited)CVE-2021-44228 (exploited)CVE-2022-0847 (exploited)CVE-2022-22965 (exploited)CVE-2023-54391 (exploited)CVE-2024-4956 (exploited)CVE-2026-35273 (exploited)CVE-2026-51990 (exploited)CVE-2026-60004 (exploited)CVE-2026-60137 (exploited)CVE-2026-63030 (exploited)CVE-2026-81578 (exploited)CVE-2026-82078 (exploited)CVE-2026-86218 (exploited)
Recent reports
Critical