UNC6032
Intelligence Profile
UNC6032 is a threat actor that weaponizes interest in AI tools, specifically targeting users with fake "AI video generator" websites to distribute malware, including Python-based infostealers and backdoors. Victims are typically directed to these sites through malicious social media ads that impersonate legitimate tools. Compromises have led to the exfiltration of sensitive data, including login credentials and credit card information, via the Telegram API. Google Threat Intelligence Group assesses UNC6032 to have a Vietnam nexus.
Threat Analysis
UNC6032 is a known-sophistication threat actor attributed to Vietnam, engaged in cyber operations with a primary motivation of unknown activity patterns.
Known Campaigns
UNC6032 is a unknown-motivation threat actor attributed to VN. UNC6032 is a threat actor that weaponizes interest in AI tools, specifically targeting users with fake "AI video generator" websites to distribute malware, including Python-based infostealers and backdoors. Victims are typically directed to these sites through malicious social me...