UNC6384

Named by 2 kept items in this workspace.

Search every workspace for UNC6384. It matches the name as written, so it can find other things that share it.

The items that name it 2

China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor
writeup2026-09-30
Previously reported by Arctic Wolf; UAT-11587 JavaScript downloader referenced the same CloudFront distribution (d32tpl7xt7175h.cloudfront.net) previously used in UNC6384 delivery activity. Talos assesses this overlap with low confidence and continues to track UAT-11587 separately.
Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign
article
China-affiliated threat actor that targeted European diplomatic and government entities last year using an unpatched Windows shortcut vulnerability, per Arctic Wolf. A CloudFront domain used by UAT-11587's JavaScript downloader was previously flagged by Arctic Wolf in connection with this campaign.

All threat actors in this workspace.