- Status
- Active
- Distinct actor
- HIGH 85%
- Named actor
- INSUFFICIENT
- First observed
- 23 Jul 2026
- Last updated
- 26 Jul 2026
- Operator language
- Chinese-language (HIGH)
- Motivation
- Financial, cryptojacking (HIGH)
Note on UTA identifiers: "UTA" stands for Unattributed Threat Actor. UTA-2026-020 is a tracking label The Hunters Ledger assigns to an actor I have observed but cannot yet link to a publicly named threat group. Other vendors and feeds will not use this label; it is specific to this publication. If later evidence ties the activity to a named actor, I will retire the label and update the report.
Summary
A two-host cluster bound by a shared reconnaissance credential and one revenue wallet, with a version-stamped toolkit and a recurring integration-bug signature. The report withholds the operator's real-world business identity, which it could not corroborate, and publishes the finding rather than the person.
The confidence levels above are the published report's figures. Every claim on this page is a summary of the linked reports, which remain the record.
Targeting
FOFA-driven mass exploitation of exposed Chinese enterprise software; the reconnaissance account and key are withheld as third-party residue per the report.
Targeting is given as region and sector, drawn from the reports. Victim names are deliberately not published here or in the reports.
Reports
Actor identifiers
Artifacts this operator chose or created: handles, channels, operator brands and domains, wallets and the like. Each is printed in a report linked above; the full indicator set, with its caveats, is in each report's IOC feed.
GOCLOUD
operator toolkit self-brand
OmniHunter
operator exploitation-orchestrator self-brand
Jianzan
operator handle on their own signed work
42CThVKA9Sx
operator Monero wallet prefix
122.51.91.77
second operator host (staging and C2)
Infrastructure and tooling
- Primary host
149.28.112.221(the operator-controlled host the assigning report is named for; the full indicator set, with its caveats, is in each report's IOC feed)- Tooling
MITRE ATT&CK
37 techniques across 12 tactics, read from the mapping tables of the reports about this actor. Each technique links to where it is mapped.
Actor profiles and the reports behind them are © Joseph, The Hunter's Ledger, licensed CC BY 4.0: free to use, including commercially, with attribution. All tracked actors.