UNC2447 is a financially motivated cybercrime group, first tracked by Mandiant in November 2020, known for its aggressive ransomware operations and data theft. The group distinguishes itself through its consistent exploitation of zero-day vulnerabilities in internet-facing appliances and its deployment of proprietary malware alongside legitimate tools. Initially designated as an uncategorized group by Mandiant, Cisco has since assessed with moderate-to-high confidence that UNC2447 operates as a subgroup of the Russia-linked WIZARD SPIDER threat group, often deploying CONTI ransomware in its campaigns. The group has been observed utilizing an affiliate program model, with activity shifting from HelloKitty to FIVEHANDS ransomware. UNC2447 primarily targets organizations in Europe and North America and engages in double extortion to pressure victims.

Aliases del actor

APT UNC2447

Actores similares

apt-unc2447actor · 1apt-45actor · 2apt-c-27actor · 2apt-c-01actor · 2apt-c-12actor · 1apt-18actor · 1apt-1877teamactor · 1apt-27actor · 1apt-30actor · 1apt-38actor · 1