UNC6748

Executive Summary

UNC6748 is a cyber threat actor targeting users in Saudi Arabia through a fake Snapchat website. They employ the GHOSTKNIFE backdoor for data exfiltration and have demonstrated evolving technical capabilities, initially using basic obfuscation and later incorporating anti-debugging measures. Their primary exploits include CVE-2025-31277 and CVE-2026-20700 for remote code execution (RCE), though inconsistencies in exploit support across iOS versions have been observed.

Goals & Targeting

UNC6748 appears to target users in Saudi Arabia through sophisticated phishing campaigns and exploitation of known vulnerabilities. Their strategic objectives likely include information gathering, potentially for espionage or financial gain. The choice of targeting a specific country suggests they may have regional interests or be aligned with actors seeking to compromise geopolitical targets. Their victims are primarily individuals who fall for their phishing attempts, though the group's long-term goals remain speculative.

UNC6748 is a cyber threat actor that has emerged as a significant concern due to their targeted attacks against users in Saudi Arabia. The group gained attention for deploying the GHOSTKNIFE backdoor, which they use to facilitate data exfiltration from compromised systems. Initially reported to have limited technical sophistication, UNC6748 demonstrated signs of evolution by enhancing their obfuscation techniques and incorporating anti-debugging measures, indicating a potential effort to evade detection and analysis. Their exploitation process primarily leverages two critical vulnerabilities: CVE-2025-31277 and CVE-2026-20700, both associated with remote code execution (RCE) capabilities. However, investigations have revealed inconsistencies in their exploit support across different iOS versions, suggesting either limited resources or a focus on specific targets. The group's attack vector initially involved creating fake Snapchat websites to deceive users into providing sensitive information or downloading malicious payloads. Over time, their delivery mechanisms have incorporated session storage checks, likely to manage infection attempts and avoid unnecessary duplication of efforts. This indicates a basic level of operational refinement. While the full scope of UNC6748's activities remains unclear due to limited公开 reporting, their targeting of Saudi Arabia suggests a potential regional or geopolitical focus, possibly aligned with espionage, financial gain, or disruptive objectives.

Key Capabilities

• Deployment of the GHOSTKNIFE backdoor
• Basic obfuscation techniques
• Anti-debugging measures
• Exploitation of CVE-2025-31277 and CVE-2026-20700 for RCE
• Session storage checks in delivery mechanisms

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

UNC6748 has operated with a regional focus, targeting individuals in Saudi Arabia through phishing campaigns and fake websites. Their campaign activity spans from first seen to last observed dates, though limited reporting obscures the full timeline. The group's victims are likely individuals who interacted with their malicious websites, potentially including Arabic-speaking users or those with specific interests in the region. While their exact modus operandi is not fully understood, their use of fake Snapchat websites and GHOSTKNIFE suggests a focus on stealth and targeted信息采集 rather than large-scale disruption.

IOC Patterns

• Phishing emails mimicking social media platforms (e.g., Snapchat)
• Fake website domains registered to host malicious content
• Network traffic associated with C2 servers used for backdoor communication
• Presence of GHOSTKNIFE backdoor on compromised systems
• Exploitation attempts targeting CVE-2025-31277 and CVE-2026-20700

Recommended Actions

• Monitor for phishing campaigns mimicking popular social media platforms
• Patch systems to address known vulnerabilities (CVE-2025-31277, CVE-2026-20700)
• Implement network traffic monitoring to detect C2 communication patterns
• Use endpoint detection and response (EDR) tools to identify malicious activities
• Conduct regular user awareness training to mitigate phishing risks

Suggested Tags