UNC2465 is a threat actor known for deploying the SMOKEDHAM .NET backdoor and DARKSIDE ransomware.
Analyst brief
UNC2465 is a threat actor that deploys the SMOKEDHAM .NET backdoor and DARKSIDE ransomware. Their targeting scope is not specified, but they impact various organizations. Key TTPs include phishing, Trojanized software installers, supply chain attacks, Cobalt Strike BEACON, LSASS memory dumping, and using NGROK for internal service exposure. Defenders should monitor for .NET backdoor activity, unauthorized NGROK usage, and signs of data exfiltration leading to extortion via TOR leaks sites.
UNC2465
unknown
UNC2465 is a threat actor known for deploying the SMOKEDHAM .NET backdoor and DARKSIDE ransomware, utilizing TTPs such as phishing, Trojanized software installers, and supply chain attacks. They have employed the NGROK utility to expose internal services and facilitate lateral movement within victim environments. UNC2465 has also leveraged tools like UltraVNC, Cobalt Strike BEACON, and conducted credential harvesting via LSASS memory dumping. Their operations have included extortion tactics through a leaks website over TOR, applying pressure on victims by releasing stolen data.