UNC215
UNC215 is a China-attributed threat actor group, tracked by Brandefense. It targets 4 sectors, including Government and Technology, in the United States and Israel.
- Origin
- China
- Techniques
- 0
- Exploited CVEs
- No CVE data
- Record updated
Who They Target.
Vulnerabilities Linked To Their Tools.
Browse Vulnerability Intelligence →Arsenal · Malware And Tools.
- China Choppermalware
- HyperBromalware
- SEASHARPEEmalware
- SysUpdatemalware
- AdFindtool
- certutiltool
- Mimikatztool
- NBTscantool
- ProcDumptool
- PsExectool
- WHEATSCANtool
- WinRARtool
Campaigns.
- UNC215 Chinese Espionage Campaign in IsraelAug 2021
About UNC215.
Since at least 2019 it has targeted Israeli government bodies, IT companies and telecommunication providers, as well as organisations in the Middle East, Europe, Asia and the United States. It often gains access by exploiting the SharePoint flaw CVE-2019-0604 to plant web shells.
It then harvests credentials, moves laterally to domain controllers and Exchange servers, and deploys its FOCUSFJORD backdoor and later HYPERBRO. The group planted Farsi strings and Iranian-style artefacts as false flags.
Last updated Oct 22, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.