UNC2447
UNC2447 is a financially motivated threat group / uncategorized cluster tracked by Mandiant and linked across intrusions by shared SOMBRAT and Cobalt Strike BEACON infrastructure observed in five intrusions between November 2020 and February 2021. Mandiant reported the group exploited the SonicWall SMA 100 series zero-day CVE-2021-20016 prior to patching and deployed the SOMBRAT backdoor in intrusions that culminated in FIVEHANDS ransomware extortion. Mandiant also observed evidence of UNC2447-affiliated actors previously using RAGNARLOCKER ransomware, and noted suspected overlap between HELLOKITTY and FIVEHANDS affiliate activity, while cautioning that not all SOMBRAT or FIVEHANDS incidents necessarily map to UNC2447 due to tool sharing and affiliate program dynamics. The group has been observed targeting organizations in Europe and North America. Observed tradecraft includes use of WARPRISM, a PowerShell dropper that loads payloads directly into memory; Cobalt Strike BEACON HTTPSSTAGER for persistence and HTTPS C2; and SOMBRAT, a 64-bit Windows backdoor with plugin-based architecture that communicates with configurable C2 over DNS, TLS-encrypted TCP, and potentially WebSockets. Mandiant described a hardened SOMBRAT variant with stripped compiler metadata, XOR-encoded inlined strings, and launcher/resource files typically installed under C:\ProgramData\Microsoft. UNC2447 has also been observed using ADFIND, BLOODHOUND, MIMIKATZ, PCHUNTER, RCLONE, ROUTERSCAN, S3BROWSER, ZAP, and 7ZIP during reconnaissance and exfiltration, and may tamper with Windows security settings, firewall rules, and antivirus protection. FOXGRABBER, a utility for harvesting Firefox credential files, was also associated with this activity. Mandiant reported UNC2447 monetized intrusions through FIVEHANDS ransomware and additional pressure tactics including threats of media exposure and offering stolen data for sale on hacker forums. Cisco later assessed with moderate-to-high confidence that its May 2022 intrusion was conducted by an initial access broker with ties to UNC2447, Lapsus$, and Yanluowang ransomware operators. In that incident, the actor used vishing and MFA fatigue to obtain VPN access, then deployed tools including LogMeIn, TeamViewer, Cobalt Strike, PowerSploit, Mimikatz, and Impacket, created persistence, dumped credentials, moved laterally, and exfiltrated limited data; Cisco stated no ransomware was deployed. Cisco also described UNC2447 as having a nexus to Russia and being known for ransomware and double extortion. Known aliases directly provided in the content are limited to UNC2447.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- technology
Tradecraft
14 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
22 malware families attributed to this actor across reporting.
17 additional families tracked in Mallory.
Associated vulnerabilities
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
Observables
33 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as an associated cluster tied (via an initial access broker) to Yanluowang-related activity; specific operations/TTPs are not detailed in this content beyond the stated linkage.
Financially motivated intrusion activity consistent with an initial access broker: vishing/MFA fatigue to obtain VPN access, enrollment of new MFA devices, privilege escalation to admin, extensive credential dumping (NTDS/SAM/LSASS), lateral movement via RDP/Citrix, log clearing/defense evasion, limited exfiltration (Box folder + AD auth data), and repeated re-entry attempts post-eviction. Content notes historical linkage to ransomware operations and double-extortion tradecraft, though no ransomware was deployed in this incident.
Financially motivated intrusion activity consistent with an initial access broker: vishing/MFA fatigue to obtain VPN access, enrollment of new MFA devices, privilege escalation to admin, extensive credential dumping (NTDS/SAM/LSASS), lateral movement via RDP/Citrix, log clearing/defense evasion, limited exfiltration (Box folder + AD auth data), and repeated re-entry attempts post-eviction. Content notes historical linkage to ransomware operations and double-extortion tradecraft, though no ransomware was deployed in this incident.
UNC2447 is associated with the deployment of FiveHands ransomware and is linked to sophisticated ransomware campaigns.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.