UNC4393
Also known as Storm-1811, CURLY SPIDER, STAC5777, Cardinal
UNC4393 is a financially motivated threat actor primarily using BASTA ransomware. They have been active since early 2022 and have targeted over 40 organizations across various industries. UNC4393 has shown a willingness to cooperate with other threat clusters for initial access and has evolved from using existing tools to developing custom malware. They focus on efficient data exfiltration and multi-faceted extortion, often utilizing tools like COGSCAN and RCLONE for reconnaissance and data theft.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
Recent activity
No posts or advisories have named this actor recently.
References
- https://cloud.google.com/blog/topics/threat-intelligence/unc4393-goes-gently-into-silentnight
- https://www.security.com/threat-intelligence/black-basta-ransomware-zero-day
- https://cloud.google.com/blog/topics/threat-intelligence/detecting-disrupting-malvertising-backdoors/
- https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/
- https://news.sophos.com/en-us/2025/01/21/sophos-mdr-tracks-two-ransomware-campaigns-using-email-bombing-microsoft-teams-vishing/
- https://www.esentire.com/security-advisories/ongoing-email-bombing-campaigns-leading-to-remote-access-and-post-exploitation
- https://redcanary.com/blog/threat-intelligence/storm-1811-black-basta/
- https://redcanary.com/blog/threat-intelligence/intelligence-insights-june-2024/
- https://x.com/MsftSecIntel/status/1881751635598139714
- https://techcommunity.microsoft.com/blog/microsoftsecurityexperts/phish-click-breach-hunting-for-a-sophisticated-cyber-attack/4267916
- https://services.google.com/fh/files/misc/m_trends_2023_report.pdf
- https://services.google.com/fh/files/misc/m-trends-2024.pdf
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.