UNC2814

ACTIVE CAMPAIGN TRACKED ▲ High Threat China

Primary Aliases: STALKER PANDA Swirl Typhoon BRONZE BUTLER CTG-2006

Sponsor / State Affiliation People's Republic of China (PRC)

Primary Motivation Strategic intelligence collection and long-term surveillance of communications data and personnel

Confidence Rating 95% (Grounded)

GRIDTIDE, AI-Enhanced Vulnerability Research

🎯 Target Sectors & Focus

Telecommunications Providers Government Entities

🛡️ MITRE ATT&CK® Attack Lifecycle (8 TTPs)

📥 Download Navigator JSON

Initial Access 1

T1566 Compromise of web servers and edge systems for initial access

Persistence & Privilege Escalation 1

T1547 Privilege escalation via xapt binary (masquerading as Debian tool)

Lateral Movement & Collection 1

T1021 SSH lateral movement

Command & Control 2

T1071 Abuse of Google Sheets API for stealthy Command and Control (C2)

T1071 Use of GRIDTIDE C-based backdoor

Operational Techniques 3

T1000 AI-augmented vulnerability research (expert persona prompting for binary analysis)

T1000 Creation of malicious systemd services

T1000 URL-safe Base64 encoding for web filtering bypass

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Agentic AI Exploit of Zero-Day Flaws in Zammad Ticketing System

Attacks and Vulnerabilities 2026-10-04

Copied to clipboard

LINK COPIED TO CLIPBOARD