UNC4393Threat actor
- Cardinal
- curly spider
- stac5777
- storm-1811
UNC4393 is a financially motivated threat actor primarily using BASTA ransomware. They have been active since early 2022 and have targeted over 40 organizations across various industries. UNC4393 has shown a willingness to cooperate with other threat clusters for initial access and has evolved from using existing tools to developing custom malware.From MISP Galaxy
Last reported 12 days ago, by RansomLook4 reports
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
brain cipher lists Trailerbridge.com“…ctim description: 76200 files containing customer data: invoices, remittances, commercial relations with major chains (Walmart, Baxter, Cardinal); customs documents (declarations, EEI, Schedule B); ...”
-
the gentlemen lists Northwestern Polytechnic“Cardinal architecture (winner of the Prix du XXe Siècle)”
-
thegentlemen lists Northwestern Polytechnic“Cardinal architecture (winner of the Prix du XXe Siècle)”
-
Risky Bulletin: BEC campaign steals €35 million from French notaries“[Cardinal News]”
Indicators in its reports
named in the reports above- collusion[.]wikiin 1 report
- hneumannmep.bsky[.]socialin 1 report
- trailerbridge[.]comin 1 report
- nwpolytech[.]cain 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.