1 malware family

UNC3973

Also known asUNC3973

UNC3973 is a financially motivated cybercrime cluster tracked separately from the main BASTA ransomware activity set because it exhibits distinct tactics, techniques, and procedures. It is associated with the BASTA ecosystem, which appears to operate through a private, tightly controlled affiliate model rather than an openly advertised ransomware-as-a-service program. Mandiant consolidated BASTA-related tracking into two principal clusters, UNC4393 and UNC3973, with UNC3973 maintained as a separate cluster due to its unique operational characteristics. High-confidence reporting in the available material ties UNC3973 to the broader BASTA intrusion and extortion ecosystem, but does not provide the same level of detailed victimology, malware usage, or tradecraft specifics that are documented for UNC4393. As a result, UNC3973 can be characterized as a distinct BASTA-associated threat cluster involved in ransomware operations, but granular attribution of particular tools, access vectors, or targeting patterns to UNC3973 specifically is not currently available from the supplied facts. Within the broader BASTA ecosystem, operators have demonstrated rapid post-compromise execution, including reconnaissance, data exfiltration, and ransomware deployment, and have relied on a tightly knit set of operators or affiliates. However, only the existence of UNC3973 as a separate BASTA-linked cluster with unique TTPs is directly supported at high confidence for this actor record.

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

MITRE ATT&CK

Tradecraft

2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

1 of 15 tactics2 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0040

Impact

2 techniques

T1486

Data Encrypted for Impact

T1490

Inhibit System Recovery

ARSENAL

Associated malware families

1 malware family attributed to this actor across reporting.

FamilyContextEvidenceLast seen

BastaBASTA is a ransomware written in C++ that encrypts local files. The ransomware is capable of deleting volume shadow copies. BASTA generates a random ChaCha20 or XChaCha20 key to encrypt each file; the key is encrypted and appended to the end of the file.1Jun 14, 2026

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malpediaNews

Mar 7, 2018

Lazarus Group (Threat Actor)

Mentioned in relation to UNC4393 reporting.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping2

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal1

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.

UNC3973

Also known asUNC3973