UNC2659

UNC2659 is a threat cluster tracked as a DARKSIDE ransomware affiliate active since at least January 2021. The cluster is associated with financially motivated ransomware intrusions and double-extortion operations in which data is stolen prior to encryption. UNC2659 is notable for exploiting CVE-2021-20016 in SonicWall SMA100 SSL VPN appliances to obtain initial access, then progressing from compromise to ransomware deployment in roughly 10 days. Observed UNC2659 tradecraft includes exploitation of internet-facing VPN infrastructure for initial access, use of TeamViewer to maintain persistence, access to administrative interfaces in virtualized environments, and pre-encryption actions intended to reduce recovery options, including disabling snapshot functionality on ESXi-managed systems. The cluster has also been observed downloading tooling from legitimate public sites and using Rclone to exfiltrate large volumes of victim data before deploying DARKSIDE ransomware. These behaviors align with post-compromise enterprise intrusion activity focused on persistence, data theft, and impact. UNC2659 is one of several affiliate-linked clusters associated with the DARKSIDE ransomware-as-a-service ecosystem. DARKSIDE operators provided ransomware tooling and leak-site support to affiliates in exchange for a share of ransom proceeds, enabling affiliates such as UNC2659 to conduct double-extortion attacks across multiple sectors and countries. No separate sub-groups or widely used aliases for UNC2659 are established beyond its tracking designation.