StrikeReady — AI-Powered Security Command Center
Excerpt
UNC1151 has operated with a higher operational tempo in 2025, and in this blog, Labs shows how to track this actor, by surfacing two clusters of activity, and tying it to previously attributed samples.
Files that leverage anti-analysis techniques can often be interesting threads to pull on. In this case, we noticed a true positive document detection that wasn’t executing properly in our analysis environment, and it quickly became clear why. For a background on UNC1151, you should read high quality articles on this actor from CERT-PL, SentinelOne, Harfang Lab, GTIG/Mandiant, and Proofpoint. The document ( Лист мадопомога.doc ec0e4a3dcfcc85ed52783f7cf2e80ddf) was leveraging a dynamic captcha, created i…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by strikeready.com on strikeready.com.
Mentioned in the excerpt
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Chinese Nation-State Hackers Target U.S in Operation TradeSecret, Report Claimseweek.com · Published 6 Apr 2017
- Taiwan High-Tech Ecosystem Targeted by Foreign APT Group:Medium · Published 10 Jun 2022
