UNC4487
UNC4487 is an uncategorized threat cluster tracked by Google Mandiant and assessed as a suspected espionage actor. The group has been active since at least October 2022. Mandiant observed UNC4487 compromising websites of Ukrainian government entities and using those compromised sites to redirect and socially engineer targets into executing malware, including MATANBUCHUS and CHILLYHELL. The actor was also linked to the compromise of a Ukrainian auto insurance website used by government officials for official travel to deliver MATANBUCHUS and CHILLYHELL. CHILLYHELL is a modular macOS backdoor attributed to UNC4487; reported capabilities include host profiling, persistence via LaunchAgent, LaunchDaemon, and shell profile injection, timestomping, HTTP and DNS command-and-control, reverse shell access, downloading updated versions of itself or additional payloads, and brute-force activity against user accounts via a module called ModuleSUBF. No additional aliases or sub-groups are provided in the source content beyond UNC4487 itself.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
Where they target
Geographies tied to known operations.
- 🇺🇦 Ukraine
Tradecraft
12 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Observables
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Deployed the ChillyHell macOS backdoor against a Ukrainian auto insurance website used by government employees.
Deployed the ChillyHell macOS backdoor against a Ukrainian auto insurance website used by government employees.
Linked to ChillyHell and previously known for targeting a Ukrainian auto insurance website to deliver MATANBUCHUS malware.
UNC4487 is linked to the deployment of the ChillyHell modular macOS backdoor, which has been used to breach a Ukrainian auto insurance website used by government officials. The group is believed to be a cybercrime group, using targeted attacks rather than wide distribution.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.