UNG0902
UNG0902 is a threat cluster tracked by Seqrite in connection with the spearphishing campaign dubbed Operation DupeHike. Seqrite states it has tracked the activity since November 2025. The cluster targets Russian corporate employees, particularly HR, payroll, internal administrative, finance, accounting, procurement, and legal functions, using realistic lures themed around employee bonuses, payment confirmations, and internal financial policies. The activity is described as targeting Russian employees and Russian corporate entities. In Operation DupeHike, phishing emails deliver ZIP archives containing PDF-themed malicious LNK files. The LNK files execute hidden PowerShell to download and run a C++ implant named DUPERUNNER. DUPERUNNER retrieves and displays decoy PDF content, downloads additional payloads disguised as .woff font files, and injects shellcode into legitimate Windows processes such as explorer.exe, notepad.exe, and msedge.exe using VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread. The injected payload is AdaptixC2, described as an open-source command-and-control framework. Seqrite reported that the AdaptixC2 beacon/stager resolves APIs dynamically through PEB traversal and hashed lookups, locates an appended PE payload via a magic marker, and communicates with attacker infrastructure over HTTP, including POST requests to a /result endpoint. Supporting reporting also links UNG0902 to campaigns targeting Russian HR and payroll departments with bonus- or policy-themed lures that deploy DUPERUNNER and load AdaptixC2. Seqrite reported malicious infrastructure associated with the activity and noted hosting under AS48282 (VDSINA-AS) and AS9123 (TIMEWEB-AS). One report states Seqrite was considering possible nation-state sponsorship, but no confirmed state attribution is provided in the content. No aliases or sub-groups other than the cluster name UNG0902 are directly supported by the content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- corporate
Associated malware families
2 malware families attributed to this actor across reporting.
Observables
12 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Activity cluster reported targeting Russian employees using the DUPERUNNER malware and AdaptixC2 infrastructure/tooling.
UNG0902 is responsible for spear-phishing campaigns targeting Russian organizations, especially human resources and payroll departments, using lures related to bonuses or internal financial policies to deploy the DUPERUNNER implant and AdaptixC2 framework.
Clustered activity targeting Russian corporate entities (notably HR, payroll, and internal administrative departments) using spear-phishing ZIPs containing PDF-themed LNK lures that execute PowerShell to download a custom implant (DUPERUNNER), which then injects/loads an AdaptixC2 beacon for HTTP-based C2.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.