UNK_LateNight
UNK_LateNight is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets the Transportation and Logistics, and Defense and Aerospace sectors in the United States. It uses 9 MITRE ATT&CK techniques.
- Techniques
- 9
- Exploited CVEs
- No CVE data
- First seen
- Sep 2, 2026
- Record updated
Who They Target.
About UNK_LateNight.
UNK_LateNight is a temporary cluster designator for a China-aligned, espionage-focused threat group first observed on 2 September 2026. The cluster sent spearphishing emails themed as business-to-business and request-for-quotation inquiries related to the U.S. defense industrial base, directing recipients to actor-controlled websites that served the BlueMoon browser-and-Windows exploit kit and subsequently loaded the ShadowPad backdoor. Public reporting assessed the activity as distinct from other BlueMoon adopters based on targeting, payload, and infrastructure, but did not attribute it to a named historical APT or a specific state organization. Victim organizations were not publicly identified.
Last updated Sep 21, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.