Nation-state APTEspionage
UNC4191
UNC4191 is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets organisations in the Philippines.
- Origin
- China
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2022
- Record updated
Who They Target.
Countries · 1
Arsenal · Malware And Tools.
- BLUEHAZEmalware
- DARKDEWmalware
- HIUPANmalware
- Ncattool
About UNC4191.
UNC4191 operations have affected a range of public and private sector entities primarily in Southeast Asia and extending to the U.S., Europe, and APJ; however, even when targeted organizations were based in other locations, the specific systems targeted by UNC4191 were also found to be physically located in the Philippines.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.