Loading threat actor…
FiveHands is a ransomware family and associated intrusion activity cluster linked to the broader HelloKitty lineage and to activity tracked by Mandiant as UNC2447. It has been referenced in connection with Thieflock-related operations and with affiliates later associated with Yanluowang intrusions, indicating overlap within the ransomware-as-a-service ecosystem rather than a fully distinct, well-documented standalone actor structure. FiveHands is known for enterprise-focused ransomware operations and for recovery inhibition behavior including deletion of volume shadow copies on compromised hosts. Available reporting ties FiveHands to ransomware development and affiliate activity that shared tactics, techniques, and procedures with later financially motivated intrusions against organizations in sectors including financial services, manufacturing, information technology services, consultancy, and engineering. Related operations used reconnaissance, credential harvesting, remote access enablement, lateral movement, data exfiltration, and pre-encryption disruption of victim environments. Observed tradecraft in linked activity includes use of loader malware during early intrusion stages, Active Directory and network discovery, browser and password-store credential theft, remote administration tooling, and extortion through encryption and threats of further disruption. FiveHands is best understood as part of a cluster of closely related ransomware operations that includes HelloKitty and Thieflock, with possible downstream affiliate relationships to Yanluowang-linked actors. The dominant motivation is financial gain through ransomware and extortion.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
10 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced only as background context for similarities between an early Yanluowang attack and Thieflock/Fivehands activity.
A named group associated in the content with developing the Thieflock ransomware operation and linked to a Yanluowang affiliate through shared TTPs.
Referenced as a possible linked ransomware group based on overlapping TTPs and historical Thieflock activity. The article says the connection is tentative and suggests the Yanluowang attacks may be conducted by a former Thieflock affiliate rather than sharing authorship.
Presented as a next-generation/follow-on family related to HelloKitty and part of the same genealogy chain.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.