UNC7228  (Back to overview)

Uncategorized threat cluster tracked by Google Threat Intelligence Group for an ARTEX-enabled intrusion campaign also tracked by Wiz Research. GTIG states that it overlaps with the PRC-nexus actor Microsoft tracks as Storm-0940. Activity dates back to at least August 2026 and affected multiple entities in the US and Europe in enterprise software, industrial automation, semiconductor manufacturing and design, and telecommunications. The actor typically moved from a first compromised account to deep system access in about four hours, once in 15 minutes, customised its tooling to victim-specific setups and fell back to open proxies when its infrastructure was blocked. The overlap with Storm-0940 is recorded as a similar relation, not as a synonym.

Associated Families

There are currently no families associated with this actor.

References