| SYMBOL | COMMON_NAME | aka. SYNONYMS |
China-nexus espionage actor that has been observed exploiting vulnerabilities in Aspera Faspex, Microsoft Exchange, and Oracle Web Applications Desktop Integrator, among others, to gain initial access to target environments.
| 2026-01-26
⋅
Trend Micro
⋅
PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups PeckBirdy GRAYRABBIT |
| 2024-09-24
⋅
Virus Bulletin
⋅
Down the GRAYRABBIT HOle - Exposing UNC3569 and its Modus Operandi KEYPLUG Cobalt Strike CROSSWALK GRAYRABBIT HelloBot HUI Loader PlugX SiestaGraph |
| 2024-04-04
⋅
Mandiant
⋅
Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies UNC3569 UNC5266 UNC5291 UNC5330 UNC5337 UTA0178 |