Loading threat actor…
Cardinal is a cybercrime threat actor tracked by multiple vendors as Storm-1811 and UNC4393 and is widely associated with the development and operation of the Black Basta ransomware. The group emerged in connection with Black Basta in 2022 and has been linked to mature ransomware tradecraft including privilege escalation, defense evasion, and post-compromise tooling intended to accelerate encryption and impair endpoint protection. Reported activity indicates that Cardinal has used Windows privilege-escalation exploits in Black Basta intrusions and has adopted bring-your-own-vulnerable-driver techniques to disable security products by loading a signed but vulnerable kernel driver and terminating protected security processes before file encryption. Black Basta operations attributed to Cardinal have also shown use of disguised update scripts, side-loaded loaders, and follow-on remote access tooling, indicating extended dwell time and post-exploitation capability. Cardinal has historically been closely associated with the Qakbot access ecosystem and, after Qakbot’s disruption in 2023, appears to have shifted toward using DarkGate-linked operators for initial access. Reporting also describes alleged ties between Cardinal and personnel or infrastructure associated with earlier Ryuk, Conti, and Trickbot criminal ecosystems, although subgroup structure is not clearly established from the available facts. Beyond financially motivated ransomware activity, Cardinal has also been identified as a participant in overtly pro-Russian disruptive and influence-oriented operations. It was named as the leader of the Russian Legion alliance, a coalition that also includes The White Pulse, Russian Partizan, and Inteid. Under that banner, Cardinal was linked to coercive cyber activity against Denmark centered on DDoS threats and psychological pressure tied to Danish military aid for Ukraine. Cardinal has also been cited among pro-Russian hacktivist actors claiming breaches of Israeli military-related networks and public leaks of stolen information. These reports indicate that Cardinal spans both cybercriminal ransomware operations and politically aligned disruptive campaigns.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
5 malware families Mallory has associated with this actor across public reporting.
2 CVEs Mallory has associated with this actor across public reporting. 2 of them are exploited in the wild (not necessarily by this actor).
6 indicators attributed to this actor. Values are masked here and available in full in Mallory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.