Threat actorChinaTracked since 2026-05

GriefLure Cluster

Also known as:Operation GriefLure

As of 2026-05-30, GriefLure Cluster is a China-nexus threat actor tracked by Threadlinqs Intelligence across 1 threat spanning apt. Also known as Operation GriefLure.

Tracked threats: 11 high
First seen: 2026-052026-05-07
Last seen: 2026-052026-05-07
ATT&CK techniques: —No mapped techniques yet
Related CVEs: 0None referenced
Attribution: ChinaNation or origin

Nation: China · 1 tracked threat(s) · Categories: APT

Activity timeline

GriefLure Cluster appears in 1 tracked threat between 2026-05-07 and 2026-05-07.

Tracked threats

Operation GriefLure — China-Nexus APT Spear-Phishing Targeting Viettel (Vietnam Military Telecom) and St. Luke's Medical Center (Philippines) with ftp.exe LotL Loader and Time-Based Polymorphic Payload AssemblyHIGH2026-05-07