← All Threat Actors
Threat Actor Profile

UNC6201

No known aliases in database
▲ High Threat
UNC6201 is a recently identified Chinese-nexus threat cluster primarily engaged in stealthy, long-term espionage. The group is characterized by its focus on compromising edge network infrastructure and utilizing living-off-the-land (LotL) techniques to maintain persistence while minimizing their digital footprint.
Origin China
Sponsor China (State-sponsored)
Motivation Strategic espionage and intelligence collection

Target Sectors

Government Telecommunications Critical Infrastructure Defense Industrial Base Diplomatic Entities

Known TTPs

Exploitation of edge-of-network devices (VPNs, Firewalls)
Living-off-the-land (LotL) techniques
Credential harvesting and reuse
DLL side-loading
Use of legitimate administrative tools for lateral movement
Command and Control (C2) via encrypted, common protocols

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…

LINK COPIED TO CLIPBOARD