UNC2814

Reported Context (4)

Described as a suspected China-nexus cyber espionage group that prompted Gemini to support vulnerability research into embedded-device targets. Google Says Threat Actor Used AI to Develop Zero-Day 2FA Bypass
GTIG observed UNC2814 using expert-persona prompts to support vulnerability research into embedded-device targets, including TP-Link firmware and OFTP implementations. GTIG Details Adversaries’ Expanding Use of AI Across Cyber Operations
Google reports that UNC2814, among other named groups, has been using AI models for vulnerability discovery and exploit development. Google Says Hackers Likely Used AI to Develop Zero-Day Exploit for Web Admin Tool
Google said this Chinese group used a persona-driven jailbreak to enhance vulnerability research on embedded devices, including TP-Link firmware with OFTP implementations. Google Says Cybercrime Group Likely Used AI to Develop Zero-Day Exploit

Malware (6)

People (1)

Threat Actors (8)

MITRE ATT&CK (13)

Vendors (4)

Products (8)

Tools (12)

Industries (4)

Countries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.