Skip to content
brandefense.io
Request A Demo
Nation-state APTEspionage

UTG-Q-008

UTG-Q-008 is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets organisations in the United States and China.

Request IOC feedRequest ATT&CK export
Techniques
0
Exploited CVEs
No CVE data
Record updated

Who They Target.

Countries · 2

Vulnerabilities Linked To Their Tools.

Browse Vulnerability Intelligence →
CVE-2025-32432Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond.ExploitedcriticalCVE-2026-10520Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote…ExploitedcriticalCVE-2021-40870Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.ExploitedcriticalCVE-2024-50603Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code.ExploitedcriticalCVE-2025-3248Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted…ExploitedcriticalCVE-2025-0282Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.ExploitedcriticalCVE-2026-42271BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary…ExploitedhighCVE-2026-105134A flaw has been found in Ahsay AhsayCBS up to 10.3.2.criticalCVE-2018-21027Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled.criticalCVE-2024-46483Xlight FTP Server <3.9.4.3 has an integer overflow vulnerability in the packet parsing logic of the SFTP server, which can lead to a heap overflow with attacker-controlled content.criticalCVE-2018-21028Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function.highCVE-2026-105133A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2.highCVE-2026-96656Plex Media Server before allows an admin user to write arbitrary files that may be executed on load.highCVE-2025-0283A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version…highCVE-2026-96654Plex Media Server before does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.mediumCVE-2026-96652Plex Media Server before allows SSRF via '/player/timeline'.mediumCVE-2026-96655Plex Media Server before allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.medium

Arsenal · Malware And Tools.

  • Frpmalware
  • XMRigmalware

About UTG-Q-008.

UTG-Q-008 is a threat actor targeting Linux platforms, primarily focusing on government and enterprise entities in China. They utilize a massive botnet network for espionage activities, including reconnaissance, brute-forcing, and Trojan component delivery. The actor has a history of compromising thousands of servers in China using a password dictionary based on Chinese Pinyin. UTG-Q-008 operates during standard working hours in the UTC+8 time zone, with potential ties to Eastern Europe.

Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.