Skip to content
Weekly Signal

Threat actor profile

UNC1069

A source-linked view of reported activity, targets and related automated campaign clusters.

Attribution caveat.Names and aliases reflect source reporting. They do not independently prove identity or responsibility.
2Reports
1Independent sources
49Highest signal
30 Jul 2026Latest activity

Known aliases

UNC1069

Correlated campaigns

APT29: Defence targeting activity69% confidence · 3 reportsUNC2814: Defence targeting activity58% confidence · 2 reportsAPT29: recently observed activity55% confidence · 1 reportsUNC4736: recently observed activity55% confidence · 1 reportsUNC6780: recently observed activity55% confidence · 1 reportsUNC1069: recently observed activity55% confidence · 1 reportsUNC1069: Defence targeting activity55% confidence · 1 reportsSandworm: Defence targeting activity55% confidence · 1 reportsFIN7: Defence targeting activity55% confidence · 1 reportsAPT28: Defence targeting activity55% confidence · 1 reportsAPT40: Defence targeting activity55% confidence · 1 reportsAPT41: Defence targeting activity55% confidence · 1 reportsAPT33: Defence targeting activity55% confidence · 1 reportsAPT34: Defence targeting activity55% confidence · 1 reportsAPT35: Defence targeting activity55% confidence · 1 reportsAPT39: Defence targeting activity55% confidence · 1 reportsAPT42: Defence targeting activity55% confidence · 1 reportsAPT37: Defence targeting activity55% confidence · 1 reportsAPT45: Defence targeting activity55% confidence · 1 reportsAPT15: Defence targeting activity55% confidence · 1 reportsAPT20: Defence targeting activity55% confidence · 1 reportsUNC1088: Defence targeting activity55% confidence · 1 reportsAPT27: Defence targeting activity55% confidence · 1 reportsAPT30: Defence targeting activity55% confidence · 1 reportsAPT31: Defence targeting activity55% confidence · 1 reportsAPT44: Defence targeting activity55% confidence · 1 reportsUNC4057: Defence targeting activity55% confidence · 1 reports

Supporting reports

Google Threat Intelligence Group · 30 Jul 2026

Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise ↗

Written by: Kelli Vanderlee, Stuart Carrera For years, the cybersecurity industry's understanding of software supply chain compromise has been anchored by a few watershed events, including Russian cyber espionage actor ICE RELIC’s (formerly known as APT29) 2020 compromise…

49

Google Threat Intelligence Group · 24 Jul 2026

Updated Cyber Threat Actor Naming System ↗

Update (July 30): A table listing the new names of select prominent threat actors was appended to this post.  Introduction  Today, Google Threat Intelligence Group (GTIG) will begin rolling out a unified naming schema for tracking threat actors.…

49