Loading threat actor…
UTA0388 is a China-aligned cyber-espionage threat actor active since at least 2025 and associated with multilingual spear-phishing campaigns designed to deliver the GOVERSHELL backdoor family. The actor has targeted organizations and individuals across North America, Europe, and Asia, with reporting indicating a particular interest in Asian geopolitical issues and a special focus on Taiwan. Observed victimology includes Taiwan’s semiconductor sector, U.S. academia, U.S. think tanks, and organizations representing Chinese minorities. Activity has also been linked to targeting of a Serbian aviation-related government department and other European institutions. UTA0388 overlaps with the cluster tracked by Proofpoint as UNK_DropPitch, and GOVERSHELL has been assessed as a successor to the earlier HealthKick malware family. UTA0388 is notable for using large language models, including ChatGPT, to help generate spear-phishing content and support malicious workflows. Campaigns used fabricated personas and organizations, often impersonating senior researchers or analysts, and delivered lures in multiple languages including English, Chinese, Japanese, French, and German. Later operations adopted rapport-building phishing, in which the actor exchanged emails with targets before sending malicious links. The actor also abused legitimate cloud and email services for staging and delivery. The actor’s malware delivery commonly relied on links to remotely hosted ZIP or RAR archives containing a benign executable and a malicious DLL. Execution was achieved through DLL side-loading or search-order hijacking, after which GOVERSHELL established persistence via scheduled tasks and enabled remote command execution. Multiple GOVERSHELL variants have been documented, including HealthKick, TE32, TE64, WebSocket, and Beacon. Across these variants, capabilities included command execution through cmd.exe or PowerShell, polling-based task retrieval, and encrypted command-and-control communications. The malware family appears to be under active development, with iterative changes in communications methods, execution flow, and operational tradecraft. High-confidence attribution to a China-aligned operator is supported by targeting patterns, Chinese-language development artifacts, and broader espionage-oriented victim selection. UTA0388’s dominant motivation is espionage.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
11 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
2 malware families Mallory has associated with this actor across public reporting.
12 indicators attributed to this actor. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.