UTA0560
UTA0560 is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets the Government sector in the United States. It uses 4 MITRE ATT&CK techniques and exploits 3 known CVEs.
- Techniques
- 4
- Exploited CVEs
- 3
- Last seen
- Sep 2, 2026
- Record updated
Who They Target.
About UTA0560.
UTA0560 is a China-linked cyber-espionage threat cluster observed targeting U.S.-based non-governmental organizations with donation-themed spearphishing. Public reporting linked the September 2026 activity with high confidence to unsuccessful campaigns observed in March 2026 based on a shared sender address, hosting IP address, and per-host staging tradecraft. In September 2026, the cluster used the BlueMoon exploit chain to compromise Chrome and Windows systems and deployed the GRIMWEDGE JScript backdoor through a DLL side-loading and scheduled-task persistence chain. Public reporting does not identify the operators, sponsoring organization, physical location, or equivalence to another named actor.
Last updated Oct 2, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.