Skip to content
Weekly Signal

← All threat actors

Threat actor profile

UNC6293

A source-linked view of reported activity, targets and related automated campaign clusters.

Attribution caveat.Names and aliases reflect source reporting. They do not independently prove identity or responsibility.

Background and history

What we know about UNC6293

UNC6293 is an identifier found in current source reporting. Threat-research teams may use different names for overlapping activity, and the available evidence does not always support a permanent or universally agreed group boundary.

This profile is built from the reports collected by The Cornish Geek rather than a fixed attribution claim. Review the supporting sources, dates, observed behaviour and target context before using the label in an operational or executive decision.

MITRE ATT&CK group index ↗

1Reports
1Independent sources
49Highest signal
20 Aug 2026Latest activity

Known aliases

UNC6293

Correlated campaigns

APT29: Defence targeting activity69% confidence · 3 reportsSTORM-2945: Defence targeting activity55% confidence · 1 reportsUNC6293: Defence targeting activity55% confidence · 1 reportsUNC7005: Defence targeting activity55% confidence · 1 reportsUNC5976: Defence targeting activity55% confidence · 1 reports

Supporting reports