# UNC6691

> As of 2026-08-17, UNC6691 is a threat actor tracked by Threadlinqs Intelligence across 2 threats spanning vulnerability, zero day. ATT&CK coverage spans 38 techniques across 12 tactics in 2 of 2 tracked threats. Most-observed techniques: T1005 (Data from Local System), T1027 (Obfuscated Files or Information), T1041 (Exfiltration Over C2 Channel).

- **Tracked threats:** 2
- **Categories:** VULNERABILITY, ZERO_DAY
- **As of:** 2026-08-17

## ATT&CK techniques observed

38 techniques observed across 2 of 2 tracked threats. Tactics: Command and Control (7), Resource Development (6), Stealth (formerly Defense Evasion) (6), Collection (4), Execution (3), Credential Access (2).

- [T1005](https://intel.threadlinqs.com/technique/T1005) Data from Local System — Collection — observed in 2 of 2 tracked threats
- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 2 of 2 tracked threats
- [T1041](https://intel.threadlinqs.com/technique/T1041) Exfiltration Over C2 Channel — Exfiltration — observed in 2 of 2 tracked threats
- [T1056](https://intel.threadlinqs.com/technique/T1056) Input Capture — Collection — observed in 2 of 2 tracked threats
- [T1068](https://intel.threadlinqs.com/technique/T1068) Exploitation for Privilege Escalation — Privilege Escalation — observed in 2 of 2 tracked threats
- [T1082](https://intel.threadlinqs.com/technique/T1082) System Information Discovery — Discovery — observed in 2 of 2 tracked threats
- [T1113](https://intel.threadlinqs.com/technique/T1113) Screen Capture — Collection — observed in 2 of 2 tracked threats
- [T1189](https://intel.threadlinqs.com/technique/T1189) Drive-by Compromise — Initial Access — observed in 2 of 2 tracked threats
- [T1190](https://intel.threadlinqs.com/technique/T1190) Exploit Public-Facing Application — Initial Access — observed in 2 of 2 tracked threats
- [T1203](https://intel.threadlinqs.com/technique/T1203) Exploitation for Client Execution — Execution — observed in 2 of 2 tracked threats
- [T1518](https://intel.threadlinqs.com/technique/T1518) Software Discovery — Discovery — observed in 2 of 2 tracked threats
- [T1555](https://intel.threadlinqs.com/technique/T1555) Credentials from Password Stores — Credential Access — observed in 2 of 2 tracked threats
- [T1657](https://intel.threadlinqs.com/technique/T1657) Financial Theft — Impact — observed in 2 of 2 tracked threats
- [T1008](https://intel.threadlinqs.com/technique/T1008) Fallback Channels — Command and Control — observed in 1 of 2 tracked threats
- [T1036](https://intel.threadlinqs.com/technique/T1036) Masquerading — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats

## Tracked threats

- [Coruna iOS Exploit Kit — 23 Exploits Across 5 Chains Targeting iOS 13-17.2.1 (CVE-2021-30952, CVE-2023-41974, CVE-2023-43000 + 20 More)](https://intel.threadlinqs.com/threat/TL-2026-0186) — CRITICAL
- [Coruna iOS Exploit Kit — Government-Grade 23-Exploit Arsenal Proliferates from Surveillance Vendor to Russian Espionage and Chinese Cybercriminals Targeting 42K+ Devices](https://intel.threadlinqs.com/threat/TL-2026-0174) — CRITICAL

## Related CVEs

25 CVEs referenced by tracked UNC6691 activity.

- [CVE-2024-23222](https://intel.threadlinqs.com/cve/CVE-2024-23222)
- [CVE-2023-43000](https://intel.threadlinqs.com/cve/CVE-2023-43000)
- [CVE-2023-42917](https://intel.threadlinqs.com/cve/CVE-2023-42917)
- [CVE-2023-42916](https://intel.threadlinqs.com/cve/CVE-2023-42916)
- [CVE-2023-41993](https://intel.threadlinqs.com/cve/CVE-2023-41993)
- [CVE-2023-41991](https://intel.threadlinqs.com/cve/CVE-2023-41991)
- [CVE-2023-41990](https://intel.threadlinqs.com/cve/CVE-2023-41990)
- [CVE-2023-41974](https://intel.threadlinqs.com/cve/CVE-2023-41974)
- [CVE-2023-41064](https://intel.threadlinqs.com/cve/CVE-2023-41064)
- [CVE-2023-41061](https://intel.threadlinqs.com/cve/CVE-2023-41061)
- [CVE-2023-38606](https://intel.threadlinqs.com/cve/CVE-2023-38606)
- [CVE-2023-37450](https://intel.threadlinqs.com/cve/CVE-2023-37450)
- [CVE-2023-32435](https://intel.threadlinqs.com/cve/CVE-2023-32435)
- [CVE-2023-32434](https://intel.threadlinqs.com/cve/CVE-2023-32434)
- [CVE-2023-32409](https://intel.threadlinqs.com/cve/CVE-2023-32409)
- [CVE-2023-32373](https://intel.threadlinqs.com/cve/CVE-2023-32373)
- [CVE-2023-28206](https://intel.threadlinqs.com/cve/CVE-2023-28206)
- [CVE-2023-28204](https://intel.threadlinqs.com/cve/CVE-2023-28204)
- [CVE-2023-23529](https://intel.threadlinqs.com/cve/CVE-2023-23529)
- [CVE-2023-23514](https://intel.threadlinqs.com/cve/CVE-2023-23514)
- [CVE-2022-48503](https://intel.threadlinqs.com/cve/CVE-2022-48503)
- [CVE-2022-46689](https://intel.threadlinqs.com/cve/CVE-2022-46689)
- [CVE-2022-42856](https://intel.threadlinqs.com/cve/CVE-2022-42856)
- [CVE-2022-32917](https://intel.threadlinqs.com/cve/CVE-2022-32917)
- [CVE-2021-30952](https://intel.threadlinqs.com/cve/CVE-2021-30952)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/UNC6691