UNC2198

UNC2198 is a financially motivated intrusion cluster associated with ransomware monetization following ICEDID-enabled initial access. The cluster has been observed targeting organizations in North America across multiple industries and conducting rapid post-compromise operations that culminate in deployment of MAZE and later EGREGOR ransomware. Activity attributed to UNC2198 overlaps with access obtained through phishing distribution chains linked to UNC2420, also publicly tracked as Shathak or TA551. UNC2198 has used ICEDID infections as an entry point and then deployed a broad post-exploitation toolkit including Cobalt Strike BEACON, SYSTEMBC, WINDARC, Metasploit METERPRETER, KOADIC, and PowerShell EMPIRE. The group performs extensive internal reconnaissance and Active Directory mapping, including use of BloodHound and standard administrative discovery commands. Observed lateral movement methods include WinRM, RDP, and remote service execution. In at least one intrusion, UNC2198 used SOURBITS to exploit CVE-2020-0787 for privilege escalation. The cluster has demonstrated strong capability in defense evasion and operational scaling, including use of droppers, BITS jobs, remote PowerShell retrieval of tooling, and rapid propagation across victim environments. Prior to ransomware deployment, UNC2198 has exfiltrated large volumes of victim data using RCLONE, indicating double-extortion tradecraft. Reported operations showed a transition from MAZE to EGREGOR in late 2020, consistent with affiliate-style ransomware monetization. Related activity previously tracked as UNC2374 and UNC2414 was later merged into UNC2198 based on shared infrastructure and tooling characteristics, indicating these designations represented closely related or overlapping operations rather than distinct long-term actors.