Loading threat actor…
UNC964 is an uncategorized intrusion cluster tracked in association with malware development and deployment artifacts linked to dropper and shell functionality. Available reporting ties the cluster to tooling categorized under droppers and shell backdoors, indicating capability in malware staging and post-compromise remote access. The cluster appears in analytic mappings that associate actor clusters with malware families and developer build-path metadata used for clustering and attribution. High-confidence public detail on UNC964’s organizational affiliation, geographic origin, victimology, or broader operational history is currently not available.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.