UNG0002 Deploys Weaponized LNK Files with Cobalt Strike and Metasploit to Target Organizations

Seqrite Labs APT-Team has uncovered a persistent threat entity, UNG0002 (Unknown Group 0002), orchestrating espionage-driven operations across Asian jurisdictions, including China, Hong Kong, and Pakistan.

Active since at least May 2024, this South-East Asia-based cluster has demonstrated a high degree of adaptability and technical prowess, targeting critical sectors such as defense, civil aviation, electrotechnical engineering, gaming, software development, and academia.

Sophisticated Espionage Campaigns

UNG0002’s operations, tracked under two major campaigns Operation Cobalt Whisper (May 2024 – September 2024) and Operation AmberMist (January 2025 – May 2025) reveal a strategic focus on intelligence gathering through sophisticated multi-stage attacks.

Their consistent use of weaponized shortcut files (LNK), VBScript, and post-exploitation tools like Cobalt Strike and Metasploit underscores their preference for evasive and impactful intrusion techniques.

During Operation Cobalt Whisper, UNG0002 executed 20 distinct infection chains, primarily targeting defense and aviation sectors with CV-themed decoy documents designed to lure victims into executing malicious payloads.

The more recent Operation AmberMist shows an evolution in their approach, incorporating lightweight custom implants such as Shadow RAT, INET RAT, and Blister DLL, alongside innovative social engineering tactics like the ClickFix Technique.

This method tricks users into running malicious PowerShell scripts via fake CAPTCHA verification pages, with instances of spoofing legitimate entities like Pakistan’s Ministry of Maritime Affairs website.

Evolving Tactics with Custom Implants

Furthermore, the group exploits DLL sideloading by abusing trusted Windows applications such as Rasphone and Node-Webkit binaries to execute malicious code while evading detection.

Their use of realistic decoy documents, often mimicking resumes of game UI designers or computer science students from reputed institutions, highlights their tailored approach to specific industries.

The group’s infrastructure also reveals consistent naming conventions and operational security, with PDB paths like “C:UsersThe FreelancersourcereposJAN25mustangx64Releasemustang.pdb” for Shadow RAT hinting at potential codenames and mimicry of other threat actors’ playbooks to obscure attribution.

Seqrite Labs assesses with high confidence that UNG0002’s focus on espionage, combined with their adaptability in adopting techniques from other threat groups, complicates efforts to pinpoint their origins beyond a South-East Asian base.

Their shift from relying on Cobalt Strike and Metasploit to developing custom RATs indicates a well-resourced operation with a persistent intent to refine their toolset.

As the threat landscape evolves, Seqrite continues to monitor this cluster, acknowledging contributions from the broader research community, including malwarehunterteam, in tracking these campaigns.

Detailed technical analyses of infection chains and campaign specifics are available in Seqrite’s comprehensive whitepaper.

Indicators of Compromise (IOCs)

Get Free Ultimate SOC Requirements Checklist Before you build, buy, or switch your SOC for 2025 - Download Now