Loading threat actor…
UNC7228 is an intrusion activity cluster tracked by Google Threat Intelligence Group and associated with an ARTEX-enabled campaign active since at least August 2026. Its activity overlaps with STORM-0940, a Microsoft-tracked PRC-nexus actor, although the two designations are not established as interchangeable aliases. The campaign has targeted and compromised organizations in the United States and Europe, including enterprise software providers, industrial automation companies, semiconductor manufacturers and designers, and telecommunications organizations, and has conducted data theft. UNC7228 uses ARTEX, a Go-based, LLM-driven, multi-agent penetration-testing and command-and-control platform, to accelerate intrusion operations. Campaign activity typically progressed from an initially compromised account to deep system access in approximately four hours, with one observed case taking 15 minutes. Operators adapted tooling to victim environments and switched to open proxies when their infrastructure was blocked. The campaign illustrates the operational use of agentic tooling to compress intrusion timelines rather than the introduction of fundamentally new attack techniques.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
1 malware family Mallory has associated with this actor across public reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.