Tactics, Techniques & Procedures (TTPs): UNC6780 specializes in 'Upstream Subversion,' targeting the software supply chain through the compromise of developer tools, CI/CD pipelines, and open-source repositories. They utilize the SANDCLOCK credential stealer, which is designed to identify and exfiltrate secrets from environment variables, configuration files, and password managers. Their latest tactic involves the 'CanisterSprawl' npm worm, which automates the propagation of malicious code within containerized environments.

UNC6780 represents a tier of 'Industrialized Espionage' that focuses on the 'Means of Production' (software development) rather than the 'End Product.' By compromising tools like Checkmarx and Bitwarden CLI, they gain a force-multiplier effect, allowing them to compromise thousands of downstream targets with a single upstream intrusion. Their 26-day 'operational pause' suggests a highly disciplined actor that takes time to analyze exfiltrated data before launching the next phase of an attack.