CL-UNK-1068
- Origin
- CN
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 12:29:36
Targeted industries: energy-and-utilities government-and-public-sector technology-and-telecommunications
Targeted regions: country_code:cn country_code:jp country_code:kr
Context
CL-UNK-1068 is a Chinese threat actor that has targeted critical infrastructure in Asia, primarily focusing on cyberespionage. They utilize cross-platform tools, including the Xnote Linux backdoor and the GodZilla web shell, to maintain a persistent presence and execute credential theft. Their TTPs involve DLL side-loading, the use of custom malware, and batch scripts to bypass security measures. The group has demonstrated a capability for data exfiltration from SQL servers and has employed tools like DumpIt and Volatility for memory analysis.
Reports & references
- Palo Alto Unit 42 — Cl Unk 1068 Targets Critical Sectors (report)