UNC4108
UNC4108 is a Mandiant-tracked threat cluster with unknown motivation. It has been observed leveraging access initially obtained by UNC5518’s ClickFix-driven access-as-a-service activity, in which victims are lured via fake CAPTCHA or verification pages into executing malicious PowerShell. In related activity, UNC4108 has been observed using PowerShell to deploy tools and payloads including VOLTMARKER and NetSupport RAT, and to conduct reconnaissance. Mandiant also reported that GhostWeaver, a PowerShell RAT/backdoor, is tracked as UNC4108 and in some cases was delivered via MintsLoader. MintsLoader is a multi-stage loader that uses obfuscated JavaScript and PowerShell stages, anti-analysis techniques, and HTTP C2 to retrieve payloads. Known aliases directly mentioned in the content are limited to the lowercase form unc4108; no additional confirmed aliases or sub-groups are provided in the source content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
25 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
8 malware families attributed to this actor across reporting.
3 additional families tracked in Mallory.
Observables
45 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Leverages initial access obtained by UNC5518 and conducts follow-on payload deployment, including NetSupport RAT and VOLTMARKER.
UNC4108 is a threat actor that leverages access provided by UNC5518 to deploy tools such as VOLTMARKER and NetSupport RAT using PowerShell.
Activity cluster associated with MintsLoader; uses it to deploy multiple secondary payloads including infostealers, form-grabber plugins, NetSupport RAT, and a backdoored BOINC client.
Activity cluster associated (in this reporting) with GhostWeaver delivery via MintsLoader to establish persistence and enable follow-on plugin loading.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.