UNG0002 Attacks Organizations with Weaponized LNK Files and Tools like Cobalt Strike and Metasploit

Seqrite Labs APT-Team has recently unraveled the covert operations of a previously undocumented threat cluster tracked as UNG0002 (Unknown Group 0002), which has launched a series of sophisticated, espionage-focused attacks across China, Hong Kong, Pakistan, and other Asian jurisdictions.

Detailed research highlights the group’s robust preference for leveraging malicious shortcut (LNK) files, VBScript, batch and PowerShell scripts to deploy an evolving arsenal of remote access tools (RATs) and post-exploitation frameworks including Cobalt Strike and Metasploit.

Dual-Campaign Evolution

UNG0002’s operations have been characterized by continuous technical progression, evident across two major campaigns: Operation Cobalt Whisper (May–September 2024) and Operation AmberMist (January–May 2025).

The former campaign primarily targeted critical sectors like defense, electrotechnical engineering, and civil aviation, utilizing a multi-stage infection process where LNK files and VBScript initiated payload drops.

In this phase, researchers observed as many as 20 unique infection chains, all featuring decoy curriculum vitae documents tailored to industry-specific interests as social engineering bait.

By early 2025, Operation AmberMist marked a strategic shift in target profile toward the gaming industry, software development, and academic institutions, introducing more lightweight, sophisticated implants including Shadow RAT, INET RAT, and Blister DLL Implant.

The attackers have also innovated their initial infection vectors, notably with the “ClickFix Technique,” using fake CAPTCHA verification pages sometimes mimicking Pakistan’s Ministry of Maritime Affairs website to entice users into running malicious PowerShell commands.

UNG0002 continued its propensity for abusing DLL sideloading techniques, employing legitimate Windows applications such as Rasphone and Node-Webkit to stealthily load malicious code while evading detection technologies.

Technical Sophistication

Technically, UNG0002 displays high adaptability and awareness of modern enterprise defense mechanisms.

Their campaigns consistently employ scripting languages (VBS, batch, PowerShell) and non-PE artifacts as loaders and droppers, paired with custom and commodity post-exploitation tools.

A notable aspect of their methodology is the deployment of encrypted shellcode blobs and tailored C2 configurations, making detection and attribution a challenge.

UNG0002’s infrastructure exhibits a persistent operational security discipline, with consistent naming conventions and layered delivery mechanisms that have remained stable across both major campaigns.

Furthermore, public analysis of malware artifacts has uncovered developer traces such as PDB paths (e.g., “C:\Users\The Freelancer\source\repos\JAN25\mustang\x64\Release\mustang.pdb”) suggesting nicknames like “Mustang” and “ShockWave”—a subtle sign of strategic mimicry, potentially designed to obfuscate attribution and imitate other threat actors’ playbooks.

Attribution remains complex, although Seqrite Labs assesses with high confidence that UNG0002 originates from the South-East Asia region, focusing on classic espionage and intelligence-gathering operations.

The group’s blend of genuine-seeming resumes (including fake tech and design professionals from prestigious institutions), sophisticated multi-stage attacks, and mimicry of rival actor techniques underline their operational maturity.

Persistently targeting organizations in defense, energy, civil aviation, academia, and gaming, the group evidences a calculated approach to regional intelligence collection.

Ongoing monitoring reveals UNG0002 as a highly adaptable adversary, likely to continue morphing its tradecraft as more intelligence surfaces.

Organizations operating in affected regions or sectors should remain vigilant, incorporating the latest IOCs and behavioral indicators into their security posture.

Indicators of Compromise (IOCs)

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant updates