UNC4393 (8191e28a-fb2d-4d50-b992-b877807a2f37)
UNC4393 is a financially motivated threat actor primarily using BASTA ransomware. They have been active since early 2022 and have targeted over 40 organizations across various industries. UNC4393 has shown a willingness to cooperate with other threat clusters for initial access and has evolved from using existing tools to developing custom malware. They focus on efficient data exfiltration and multi-faceted extortion, often utilizing tools like COGSCAN and RCLONE for reconnaissance and data theft.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| UNC4393 (8191e28a-fb2d-4d50-b992-b877807a2f37) | Threat Actor | Storm-1811 (6784f384-a942-5d7a-b693-4f8e383d54e0) | Microsoft Activity Group actor | 1 |