Loading threat actor…
UNC6783 is a financially motivated threat cluster associated with targeted social engineering, phishing, and data-theft extortion operations against high-value enterprises. The actor has been assessed as potentially tied to the Raccoon or Mr. Raccoon persona. Its operations emphasize compromise of business process outsourcing providers, call centers, and enterprise support or helpdesk functions as an entry point into downstream customer environments. UNC6783 commonly targets support ecosystems where identity verification, account recovery, and privileged customer interactions occur under operational pressure. Observed tradecraft includes live-chat social engineering that directs victims to spoofed Okta login pages, credential theft, theft of clipboard contents to bypass standard multifactor authentication workflows, and enrollment of attacker-controlled devices to maintain persistent access. The actor has also used fake security software updates to induce victims to install remote-access malware. After obtaining trusted access, UNC6783 uses valid accounts to access sensitive enterprise data and conduct extortion. Reported post-compromise behavior includes exfiltration of data from support platforms and related enterprise systems, followed by ransom notes delivered through Proton Mail as part of data-theft extortion rather than confirmed encryption-based ransomware deployment. The actor’s intrusion pattern aligns with attacks on outsourced support operations and SaaS helpdesk environments, including abuse of trusted support access to reach multiple client organizations. UNC6783 has been linked in reporting to campaigns affecting dozens of organizations across multiple sectors.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
20 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a comparative example for geolocation-anomaly detection because it used anonymizing services that caused country-switching login patterns.
Financially motivated threat actor conducting targeted social engineering, phishing, and data theft extortion campaigns, with a focus on compromising business process outsourcers, help desks, and support staff to gain trusted access and steal sensitive data.
Financially motivated extortion crew targeting high-value corporations by compromising call centers and business process outsourcers, then using stolen credentials and helpdesk-focused social engineering to access customer environments and steal sensitive data for extortion.
Financially motivated extortion and social engineering campaign targeting organizations via their business process outsourcing providers and help desk staff to gain persistent access.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.