UNC2447

Also known as: UNC2447

UNC2447 is a financially motivated threat actor with ties to multiple hacker groups. They have been observed deploying ransomware, including FiveHands and Hello Kitty, and engaging in double extortion tactics. They have been active since at least May 2020 and target organizations in Europe and North America.

🌍 Country ["[Unknown]"]

Introduction

UNC2447 is a financially motivated threat actor with ties to multiple hacker groups. They have been observed deploying ransomware, including FiveHands and Hello Kitty, and engaging in double extortion tactics. They have been active since at least May 2020 and target organizations in Europe and North America.

Activities and Tactics

Country of Origin: 🏳️ [“[Unknown]”]

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • 7-Zip:
  • AdFind:
  • BloodHound:
  • Cobalt Strike:
  • DeathRansom:
  • FIVEHANDS:
  • FOXGRABBER:
  • HELLOKITTY:
  • Mimikatz:
  • PCHUNTER:
  • RCLONE:
  • ROUTERSCAN:
  • RagnarLocker:
  • S3BROWSER:
  • SombRAT:
  • WARPRISM:
  • ZAP:

Attribution and Evidence

Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.

References

References pending cataloguing.