UNC2447

UNC2447 is a financially motivated cybercrime cluster tracked by Mandiant, associated with FIVEHANDS ransomware and the SOMBRAT backdoor. Its activity was clustered across five intrusions between November 2020 and February 2021 using shared SOMBRAT and Cobalt Strike BEACON infrastructure. It has targeted organizations in North America and Europe. UNC2447 monetizes intrusions through ransomware encryption and data-theft extortion, threatening media exposure and offering stolen victim data for sale on criminal forums. UNC2447-affiliated actors have also deployed RAGNARLOCKER ransomware. The group exploited CVE-2021-20016, an unauthenticated SQL injection vulnerability in SonicWall Secure Mobile Access 100 series appliances, before patches became available in February 2021. Its tooling includes the WARPRISM PowerShell dropper, Cobalt Strike BEACON, and SOMBRAT. WARPRISM loads payloads directly into memory to evade endpoint detection. SOMBRAT is a modular Windows backdoor that downloads and executes plugins and supports DNS and TLS-encrypted TCP command-and-control. Variants used in these intrusions incorporate obfuscation and anti-analysis hardening. UNC2447 uses Cobalt Strike for persistent access and HTTPS command-and-control, and employs tools including AdFind, BloodHound, Mimikatz, Advanced IP Scanner, RouterScan, Rclone, S3 Browser, and 7-Zip for reconnaissance, credential acquisition, data collection, and exfiltration. Its operations demonstrate advanced detection evasion and efforts to minimize forensic evidence. Shared tooling and affiliate-based ransomware operations mean that SOMBRAT or FIVEHANDS deployment alone does not establish attribution to UNC2447.