UNC215__2021__UNC215_Spotlight_on_a_Chinese_Espionage_Campaign_in_Israel_FireEye_Inc.pdf

FireEye/Mandiant assess UNC215, a Chinese espionage group active in the Middle East, focusing on Israel, and describes its post-compromise tradecraft, credential harvesting and reconnaissance, use of backdoors such as FOCUSFJORD and HYPERBRO, web shells, and methods to evade detection and leverage trusted relationships for lateral movement, along with observed infrastructure and false-flag indicators and attribution considerations.