Loading threat actor…
UNC2984 is a Mandiant-tracked uncategorized threat cluster name appearing in reporting on adversary abuse of legitimate VPN, proxy, and localhost tunneling software. High-confidence public details about UNC2984 itself are currently not available. The available context associates the name only with broader research into how threat actors use legitimate remote-access and traffic-relaying tools to blend malicious activity with normal administration, encrypt communications, bypass network controls, and maintain access. Techniques discussed in that context include use of VPN and proxy software, localhost tunneling utilities, renamed binaries for masquerading, configuration-file abuse, and infrastructure patterns that complicate attribution and detection. No corroborated, actor-specific information is available here on UNC2984’s origin, victimology, industry focus, operational history, malware families, or motivation.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.