UNC2717

Executive Summary

UNC2717 is a sophisticated threat actor engaging in espionage activities aligned with Chinese government priorities. They are known for advanced tradecraft and evasive tactics, targeting global government agencies to steal sensitive information such as credentials and intellectual property.

Goals & Targeting

UNC2717 appears to focus on advancing Chinese government interests through espionage activities. Their primary targets include global government agencies, likely to gain access to diplomatic and military communications. The group's goal is to collect sensitive information such as credentials, email communications, and intellectual property, which could be used for strategic advantage.

UNC2717 is a state-sponsored Advanced Persistent Threat (APT) group that has demonstrated a high level of technical expertise and operational discipline. Their activities are primarily focused on espionage, with a particular emphasis on stealing sensitive data from government agencies and private sector entities. They have been observed using sophisticated malware families such as HARDPULSE, QUIETPULSE, and PULSEJUMP to infiltrate victims' networks. These tools are designed to avoid detection, making UNC2717 a challenging threat for network defenders. The group's targeting strategy is aligned with Chinese strategic interests, suggesting they may be part of a broader effort to gather intelligence that could benefit national security objectives.

Key Capabilities

• Advanced persistent threat (APT) capabilities
• Spear-phishing campaigns with malware-laced emails
• Malware development and deployment
• C2 infrastructure using DNS for communication
• Credential harvesting
• Lateral movement within networks
• Exfiltration of data

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

UNC2717 has been active for several years, with campaigns targeting government agencies globally. Their operational tempo is methodical, with a focus on long-term access and data exfiltration. Notable past operations include the use of HARDPULSE malware to compromise victim systems, followed by the deployment of additional tools for persistence and lateral movement. The group's ability to adapt their tactics and evade detection makes them a significant threat.

IOC Patterns

• Spear-phishing emails with malicious attachments or links
• Malware droppers masquerading as legitimate files
• C2 communication over DNS channels
• Presence of custom malware such as HARDPULSE, QUIETPULSE, and PULSEJUMP
• Staging infrastructure hosted on compromised servers

Recommended Actions

• Implement multi-layered email filtering to detect phishing attempts.
• Monitor for unusual network traffic and DNS queries unrelated to normal business operations.
• Conduct regular updates of software and patch management programs.
• Use endpoint detection and response (EDR) tools to identify and block malicious activities.
• Strengthen authentication mechanisms and implement multi-factor authentication (MFA).

Suggested Tags