Loading threat actor…
UNC4210 is a suspected Turla-linked intrusion cluster associated with selective follow-on exploitation of victims initially reached through legacy ANDROMEDA infections. The activity has been observed targeting at least a Ukrainian organization. In the documented intrusion, access began via an infected USB drive and execution of a malicious shortcut file, after which a legacy ANDROMEDA sample established persistence and beaconed through infrastructure tied to expired or re-registered domains. UNC4210 used that foothold to profile victims and only delivered additional tooling to systems assessed as operationally interesting. The cluster has used KOPILUWAK, a JavaScript-based reconnaissance and victim-profiling utility, to collect host and network information, execute discovery commands, and transmit results to command-and-control infrastructure. Follow-on activity included deployment of QUIETCANARY, also known as Tunnus, a lightweight .NET backdoor used for interactive command execution and post-compromise operations. UNC4210 also used archival tooling to collect, stage, and exfiltrate documents from compromised systems, indicating an intelligence-collection objective rather than disruptive or financially motivated operations. Observed tradecraft includes removable-media-based initial access, persistence through legacy malware, selective second-stage delivery, reconnaissance, command execution, and data exfiltration. The operational pattern of reviving abandoned infrastructure associated with older commodity malware and then using it to identify and escalate against higher-value victims is a notable characteristic of this cluster. UNC4210 is best understood as a suspected Turla-associated espionage actor or sub-cluster focused on covert victim selection and follow-on collection.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
18 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.