Unc2970 — Threat Actor Profile, Campaigns & Targets

Threat entity extracted from intelligence sources

Frequency
7
occurrences
First Seen
February 12, 2026
Last Seen
February 13, 2026

Related Threat Clusters

  • State-Sponsored Hackers Exploit Google's Gemini AI for Cyberattacks

    State-backed hackers from China, Iran, North Korea, and Russia are utilizing Google's Gemini AI model to facilitate various stages of cyberattacks, including reconnaissance and post-compromise actions. Notably, the…

    162 articles · Updated February 12, 2026
  • Rise in AI Model Theft and Misuse by Threat Actors

    Google's Threat Intelligence Group (GTIG) reports an increase in attempts to extract and replicate AI model logic, with state-backed and financially motivated attackers leveraging generative AI for reconnaissance,…

    13 articles · Updated February 12, 2026

Recent Intelligence Reports

  • Google fears massive attempt to clone Gemini AI through model extraction — Csoonline · February 13, 2026
  • Google: State-backed hackers using Gemini AI at every stage of attacks — Computing · February 13, 2026
  • Adversaries Exploiting Proprietary AI Capabilities, API Traffic to Scale Cyberattacks — Thecyberexpress · February 13, 2026
  • Nation-State Hackers Embrace Gemini AI for Malicious Campaigns, Google Finds — Infosecurity-Magazine · February 12, 2026
  • Google warns of AI model theft & state-backed misuse — Itbrief.Au · February 12, 2026
  • Google warns of AI model theft & state — Securitybrief.Au · February 12, 2026
  • Google says hackers are abusing Gemini AI for all attacks stages — Bleepingcomputer · February 12, 2026

CVSS v3.1 Breakdown