Operation Cobalt Whisper — APT Profile
Operation Cobalt Whisper is the label Quick Heal's Seqrite Labs gave to a cyber-espionage campaign it published on 24 October 2024. The activity ran from May to September 2024 and was concentrated on Hong Kong and Pakistan, hitting predominantly researchers in the former and the defence sector in the latter; affected verticals also included electrotechnical engineering, hydropower and renewable energy, civil aviation, environmental engineering, academia, medical science institutions and cybersecurity researchers. Seqrite documented 20 distinct infection chains, 18 of them aimed at Hong Kong and two at Pakistan. Intrusions began with malicious RAR archives carrying decoy documents and an LNK shortcut, which launched obfuscated VBScript that established persistence through a scheduled task and loaded Cobalt Strike, the operation's principal post-exploitation tool; the decoys leaned on themes such as prestigious events and research awards. In July 2025 Seqrite folded the campaign into the wider cluster it tracks as UNG0002 — assessed with high confidence to originate from South-East Asia — alongside a successor operation named AmberMist that ran from January to May 2025.Also tracked as
UNG0002, Unknown Group 0002
Tools & malware
- Blister Loader
- Cobalt Strike Post-exploitation framework
- INET RAT Remote access trojan
- Metasploit Post-exploitation framework
- Shadow RAT Remote access trojan
Vendor research
- Recent malicious activities attributed to the UNG0002 threat group (Protection Bulletin, 23 Jul 2025) Symantec (Broadcom)
- Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan Seqrite Labs
- UNG0002: Regional Threat Operations Tracked Across Multiple Asian Jurisdictions Seqrite Labs