Loading threat actor…
UTA-2026-024 is an unidentified post-exploitation activity cluster that compromised an unnamed United States organization and sought durable control of its Windows Active Directory environment. The operation used a Sliver beacon and tooling for credential access, including collection of Windows credential-related registry hives and LSASS memory dumping with Mimikatz. Operators created privileged domain and local accounts, enabled Remote Desktop Protocol while disabling Network Level Authentication, and disabled endpoint-protection services. Persistence was established through SYSTEM-level scheduled tasks with forged metadata and backdated registration details; a recurring task retrieved the current payload chain without retaining a fixed payload locally. The activity also modified DNS-filtering administration and internal DNS resolution to permit attacker command-and-control communications. A Node.js implant resolved changing command-and-control domains through a publicly readable Ethereum smart contract, providing resilient infrastructure rotation. Infrastructure associated with the activity has been linked to a separate ransomware incident, but ransomware deployment was not observed in this intrusion and no responsible threat actor has been identified.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
18 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 malware families Mallory has associated with this actor across public reporting.
13 indicators attributed to this actor. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.