UNC6508
Reports
5
First seen
Jun 15, 2026
Last seen
Sep 8, 2026
Motivation
Espionage
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Sectors
Victim regions
×1×2
United States×2
Canada×1
Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.
Top ATT&CK techniques
T1041 Exfiltration Over C2 Channel ×5T1190 Exploit Public-Facing Application ×4T1087 Account Discovery ×4T1003 OS Credential Dumping ×3T1566 Phishing ×2T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage ×2T1059 Command and Scripting Interpreter ×2T1090 Proxy ×2T1547 Boot or Logon Autostart Execution ×2T1555 Credentials from Password Stores ×2T1110 Brute Force ×2T1078 Valid Accounts ×1
Indicators
cve ×2domain ×2email ×1
Indicator values are available on Pro and via the API.
Associated CVEs
Recent reports
High