UNC6353Threat actor
suspected Russian espionage group.From MISP Galaxy
Last reported 4 days ago, by The Hacker News2 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1195Supply Chain Compromise
“Supply-chain compromise of Trivy vulnerability scanner”
- T1684Social Engineering
“The group impersonated Iraq's Ministry of Foreign Affairs using social engineering lures, including ClickFix-style attacks, to deploy several .NET malware families.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader“…dings are consistent with a report from Google Threat Intelligence Group (GTIG) in March 2026, which linked the Russian espionage actor UNC6353 to the use of Coruna and DarkSword kits in watering-hole campaigns targeting Ukrainian users since summer 2025.”
-
Cyber Brief 26-04 - March 2026“On March 18, multiple actors, including commercial surveillance vendor PARS Defense and Russia-linked UNC6353, deployed DarkSword, an iOS full-chain exploit leveraging six vulnerabilities, including zero-days, to fully compromise devices running iOS 18.4–18.7.”
Indicators in its reports
named in the reports above- 185.82.218[.]119in 1 report
- 91.149.221[.]118in 1 report
- 91.149.221[.]123in 1 report
- 166.88.239[.]54in 1 report
- 194.87.108[.]12in 1 report
- 194.87.108[.]217in 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.