CL-UNK-1068 Targets Asian Critical Infrastructure with Web Server Exploits and Mimikatz
Summary
Hide ▲
Show ▼
A previously undocumented Chinese threat actor, CL-UNK-1068, has been targeting critical infrastructure in South, Southeast, and East Asia since at least 2020. The campaign, attributed to cyber espionage with moderate-to-high confidence, has affected sectors including aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications. The attackers use a mix of custom malware, open-source utilities, and LOLBINs to maintain persistence and exfiltrate data. The group employs tools like Godzilla, ANTSWORD, Xnote, and Fast Reverse Proxy (FRP) to target both Windows and Linux environments. They exploit web servers to deliver web shells, move laterally, and steal sensitive files. The attackers also use Mimikatz and other tools to dump passwords and extract credentials.
Timeline
-
09.03.2026 09:21 1 articles · 3h ago
CL-UNK-1068 Exploits Web Servers and Uses Mimikatz in Asian Cyber Espionage Campaign
Since at least 2020, CL-UNK-1068 has been targeting critical infrastructure in South, Southeast, and East Asia. The group uses a mix of custom malware, open-source utilities, and LOLBINs to maintain persistence and exfiltrate data. They exploit web servers to deliver web shells, move laterally, and steal sensitive files. The attackers also use Mimikatz and other tools to dump passwords and extract credentials, indicating a strong focus on cyber espionage.
Show sources
- Web Server Exploits and Mimikatz Used in Attacks Targeting Asian Critical Infrastructure — thehackernews.com — 09.03.2026 09:21
Information Snippets
-
CL-UNK-1068 has been active since at least 2020, targeting critical infrastructure in South, Southeast, and East Asia.
First reported: 09.03.2026 09:211 source, 1 articleShow sources
- Web Server Exploits and Mimikatz Used in Attacks Targeting Asian Critical Infrastructure — thehackernews.com — 09.03.2026 09:21
-
The group uses a mix of custom malware, open-source utilities, and LOLBINs to maintain persistence and exfiltrate data.
First reported: 09.03.2026 09:211 source, 1 articleShow sources
- Web Server Exploits and Mimikatz Used in Attacks Targeting Asian Critical Infrastructure — thehackernews.com — 09.03.2026 09:21
-
Tools used include Godzilla, ANTSWORD, Xnote, and Fast Reverse Proxy (FRP).
First reported: 09.03.2026 09:211 source, 1 articleShow sources
- Web Server Exploits and Mimikatz Used in Attacks Targeting Asian Critical Infrastructure — thehackernews.com — 09.03.2026 09:21
-
The attackers exploit web servers to deliver web shells and move laterally to other hosts.
First reported: 09.03.2026 09:211 source, 1 articleShow sources
- Web Server Exploits and Mimikatz Used in Attacks Targeting Asian Critical Infrastructure — thehackernews.com — 09.03.2026 09:21
-
Mimikatz is used to dump passwords from memory, and other tools like LsaRecorder and DumpItForLinux are used for credential theft.
First reported: 09.03.2026 09:211 source, 1 articleShow sources
- Web Server Exploits and Mimikatz Used in Attacks Targeting Asian Critical Infrastructure — thehackernews.com — 09.03.2026 09:21