Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · UNC4393 · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

UNC4393

  • Storm-1811
  • CURLY SPIDER
  • STAC5777
  • Cardinal

MITRE G1046 ↗

UNC4393 — ATT&CK roseUN

attack rose · 31 techniques across 12 tactics

Analyst brief

misp-galaxy + mitre-attack

UNC4393 is a financially motivated threat actor primarily using BASTA ransomware. They have been active since early 2022 and have targeted over 40 organizations across various industries. UNC4393 has shown a willingness to cooperate with other threat clusters for initial access and has evolved from using existing tools to developing custom malware. They focus on efficient data exfiltration and multi-faceted extortion, often utilizing tools like COGSCAN and RCLONE for reconnaissance and data theft.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

31 techniques · 12 of 15 tactics

  1. Resource development

    3 techniques

  2. Initial access

    3 techniques

  3. Execution

    3 techniques

  4. Persistence

    1 technique

  5. Stealth

    7 techniques

  6. Defense impairment

    1 technique

  7. Discovery

    3 techniques

  8. Lateral movement

    3 techniques

  9. Collection

    2 techniques

  10. Command and control

    2 techniques

  11. Exfiltration

    1 technique

  12. Impact

    2 techniques

select a technique

Arsenal

3 malware · 4 tools
Malware
Malware · 3ATT&CK
Black BastaS1070 ↗
Cobalt StrikeS0154 ↗
QakBotS0650 ↗
Tools
Tools · 4ATT&CK
Quick AssistS1209 ↗
BITSAdminS0190 ↗
PsExecS0029 ↗
ImpacketS0357 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

18 sources
  1. 1.cloud.google.com/blog/topics/threat-intelligence/unc4393-goes-gently-in…
  2. 2.security.com/threat-intelligence/black-basta-ransomware-zero-day
  3. 3.cloud.google.com/blog/topics/threat-intelligence/detecting-disrupting-m…
  4. 4.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-…
  5. 5.news.sophos.com/en-us/2025/01/21/sophos-mdr-tracks-two-ransomware-camp…
  6. 6.esentire.com/security-advisories/ongoing-email-bombing-campaigns-le…
  7. 7.redcanary.com/blog/threat-intelligence/storm-1811-black-basta
  8. 8.redcanary.com/blog/threat-intelligence/intelligence-insights-june-20…
  9. 9.x.com/MsftSecIntel/status/1881751635598139714
  10. 10.techcommunity.microsoft.com/blog/microsoftsecurityexperts/phish-click-breach-hunti…
  11. +8 more in the JSON record

Track UNC4393 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.