Skip to content

Unknown threat actor

Named by 2 kept items in this workspace.

Search every workspace for Unknown threat actor. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • Socket: Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers
    writeup2026-07-29It is written here as Unknown threat actor (likely Chinese-speaking).

    Operators behind a distributed npm package cluster campaign targeting Alibaba developers; attribution based on Chinese-language code comments, UTC+0800 GitHub commit timestamps, and targeting of Chinese-speaking enterprise tools (DingTalk, Wukong, Qoder). Goal assessed as industrial espionage.

  • Meta Phishers Abuse Business Account Manager Service | Huntress
    writeup2026-07-07It is written here as Unknown threat actor (Meta Business Manager phishing campaign).

    Abused Meta's Business Account Manager service to send phishing emails from a legitimate Meta email address ([email protected]), starting late last year; active attacks observed through June 2026 (per honeypot observation on June 2). Set up phishing pages to steal Meta business account credentials,

All threat actors in this workspace.