- Status
- Active
- Distinct actor
- MODERATE 72%
- Named actor
- INSUFFICIENT
- First observed
- 3 Apr 2026
- Last updated
- 3 Apr 2026
- Motivation
- Assessed as a generic crimeware operator; named-group attribution rejected
Note on UTA identifiers: "UTA" stands for Unattributed Threat Actor. UTA-2026-002 is a tracking label The Hunters Ledger assigns to an actor I have observed but cannot yet link to a publicly named threat group. Other vendors and feeds will not use this label; it is specific to this publication. If later evidence ties the activity to a named actor, I will retire the label and update the report.
Summary
A multi-framework C2 toolkit exposed on one VPS, with a probable second operator server identified by a matching pattern of OPSEC failures in the same two-week window. Build-path and character-set artifacts in the implant point to a Chinese-language operator environment, which the report is careful to separate from any named Chinese-nexus group.
The confidence levels above are the published report's figures. Every claim on this page is a summary of the linked reports, which remain the record.
Targeting
No victims identified; targeting could not be assessed.
Targeting is given as region and sector, drawn from the reports. Victim names are deliberately not published here or in the reports.
Reports
Actor identifiers
Artifacts this operator chose or created: handles, channels, operator brands and domains, wallets and the like. Each is printed in a report linked above; the full indicator set, with its caveats, is in each report's IOC feed.
iamem
developer username in a recovered PDB path
92.60.75.103
probable second operator server
Infrastructure and tooling
- Primary host
193.56.255.154(the operator-controlled host the assigning report is named for; the full indicator set, with its caveats, is in each report's IOC feed)- Tooling
MITRE ATT&CK
24 techniques across 6 tactics, read from the mapping tables of the reports about this actor. Each technique links to where it is mapped.
Actor profiles and the reports behind them are © Joseph, The Hunter's Ledger, licensed CC BY 4.0: free to use, including commercially, with attribution. All tracked actors.