Threat actor

UNC5277

Updated 5 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVEs0Associated

Malware1Family

ATT&CK0Techniques

IOCs0Tracked

Motivation: —

Also known asUNC5277

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Malware

Associated malware families

1 malware family Mallory has associated with this actor across public reporting.

FamilyContextEvidenceLast seen

AkiraAkira (also known as REDBIKE) has emerged as one of the most disruptive ransomware operations targeting small-to-medium-sized businesses (SMBs) across North America and Europe.1Oct 20, 2026

Activity feed

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

itsec asia intellibron blogNews · Sep 11, 2025Static Analysis of Akira RansomwareA financially motivated activity cluster observed using REDBIKE/Akira ransomware to extort victims. The content does not establish it as an Akira subgroup or provide cluster-specific targeting or intrusion details.Read more ↗

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what's public. Mallory adds the parts that aren't: whether this actor's tooling has touched your footprint, the IOCs they're burning right now, and the detections to deploy next.

Start Free Trial Open in App ↗

Target overlapMatch sector + geo + tech-stack targeting against your real footprint.

Tradecraft mappingMITRE ATT&CK techniques reported for this actor, grouped by tactic.

Associated malware1Families linked to this actor, with IOCs and behavior.

Associated CVEsCVEs linked to this actor, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

ObservablesDomains, IPs, and hashes tied to this actor, refreshed continuously.

Threat actor

UNC5277

Updated 5 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVEs0Associated

Malware1Family

ATT&CK0Techniques

IOCs0Tracked

Motivation: —

Also known asUNC5277

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Malware

Associated malware families

1 malware family Mallory has associated with this actor across public reporting.

FamilyContextEvidenceLast seen

AkiraAkira (also known as REDBIKE) has emerged as one of the most disruptive ransomware operations targeting small-to-medium-sized businesses (SMBs) across North America and Europe.1Oct 20, 2026

Activity feed

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what's public. Mallory adds the parts that aren't: whether this actor's tooling has touched your footprint, the IOCs they're burning right now, and the detections to deploy next.

Start Free Trial Open in App ↗

Target overlapMatch sector + geo + tech-stack targeting against your real footprint.

Tradecraft mappingMITRE ATT&CK techniques reported for this actor, grouped by tactic.

Associated malware1Families linked to this actor, with IOCs and behavior.

Associated CVEsCVEs linked to this actor, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

ObservablesDomains, IPs, and hashes tied to this actor, refreshed continuously.