Threat actor profile

UNC6780

A source-linked view of reported activity, targets and related automated campaign clusters.

Attribution caveat.Names and aliases reflect source reporting. They do not independently prove identity or responsibility.

2Reports

1Independent sources

67Highest signal

30 Jul 2026Latest activity

Known aliases

UNC6780

Correlated campaigns

UNC2814: Defence targeting activity58% confidence · 2 reports UNC6780: Defence targeting activity55% confidence · 1 reports APT29: recently observed activity55% confidence · 1 reports UNC4736: recently observed activity55% confidence · 1 reports UNC6780: recently observed activity55% confidence · 1 reports UNC1069: recently observed activity55% confidence · 1 reports

Supporting reports

Google Threat Intelligence Group · 11 May 2026

GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access ↗

Executive Summary Since our February 2026 report on AI-related threat activity, Google Threat Intelligence Group (GTIG) has continued to track a maturing transition from nascent AI-enabled operations to the industrial-scale application of generative models within adversarial workflows. This…

Google Threat Intelligence Group · 30 Jul 2026

Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise ↗

Written by: Kelli Vanderlee, Stuart Carrera For years, the cybersecurity industry's understanding of software supply chain compromise has been anchored by a few watershed events, including Russian cyber espionage actor ICE RELIC’s (formerly known as APT29) 2020 compromise…