UNC2465

UNC2465 is a financially motivated cybercriminal threat cluster active since at least April 2019 that conducts ransomware and data-leak extortion operations. It has operated as a ransomware-as-a-service affiliate using DarkSide and LockBit. Its intrusions center on SMOKEDHAM, a PowerShell-based .NET backdoor supporting arbitrary command execution, screen capture, and keylogging. UNC2465 obtains initial access through phishing, malicious shortcuts distributed through legitimate file-hosting services, and trojanized software installers. It has compromised a legitimate security-camera software provider's website to replace downloadable installers and has used malvertising to distribute counterfeit software packages. Infection chains employ DLL sideloading, obfuscated PowerShell, and persistence through registry autorun entries, startup shortcuts, scheduled tasks, and Windows service manipulation. SMOKEDHAM uses encrypted command-and-control communications and domain fronting to conceal attacker infrastructure. After compromise, UNC2465 uses tools including Advanced IP Scanner and BloodHound for discovery, Mimikatz and LSASS memory dumping for credential theft, and keyloggers for surveillance. It deploys Cobalt Strike Beacon and abuses legitimate remote-access tools such as UltraVNC. Ngrok tunnels expose internal remote-desktop services and bypass network restrictions, while RDP, WMI, and PsExec facilitate lateral movement. The actor has targeted backup platforms, deleted backup routines, erased backup data, and altered permissions to obstruct recovery. Its extortion activity combines ransomware encryption with threats to disclose stolen information, and operators have called victim support lines to direct attention to ransom notes.