Loading threat actor…
UNC2447 is a financially motivated cybercrime cluster tracked for intrusions spanning late 2020 into 2021 and associated with ransomware and extortion activity. The group is best known for exploiting SonicWall SMA 100 Series appliances, including the zero-day CVE-2021-20016 before patches were available, and for deploying the SOMBRAT backdoor and FIVEHANDS ransomware. Reporting also links UNC2447-affiliated activity to prior use of RagnarLocker, and to infrastructure and tradecraft later associated with HelloKitty, Thieflock, and some Yanluowang-linked operations, although not every overlap establishes common authorship. UNC2447 has targeted organizations in North America and Europe. Victimology described for related campaigns includes financial organizations and other enterprise targets, with broader ransomware-related reporting also placing the actor against multiple North American and European organizations. The group’s operations are characterized by aggressive monetization through ransomware encryption and extortion pressure, including threats of public exposure and sale of stolen data. Tradecraft attributed to UNC2447 includes initial access through exploitation of internet-facing appliances, especially SonicWall VPN infrastructure, followed by deployment of Cobalt Strike Beacon for persistence and command and control. The cluster has been tied together through shared SOMBRAT and Cobalt Strike infrastructure. SOMBRAT is used as a modular backdoor with anti-analysis hardening and plugin-based post-compromise functionality. UNC2447 has also used WARPRISM, a PowerShell in-memory dropper, and has demonstrated efforts to evade detection and reduce post-intrusion forensic visibility. Post-compromise behavior includes reconnaissance, credential access, lateral movement, and exfiltration. Observed tooling includes AdFind, BloodHound, Mimikatz, RouterScan, 7-Zip, Rclone, S3 Browser, and other utilities used for discovery and data theft. The actor has also been associated with use of Advanced IP Scanner for internal reconnaissance. Reporting notes tampering with Windows security settings, firewall rules, and antivirus protections. UNC2447 has been assessed as displaying advanced operational capability for a financially motivated actor, particularly in stealth, infrastructure reuse, and pre-ransomware intrusion management.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
21 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
23 malware families attributed to this actor across reporting.
18 additional families tracked in Mallory.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
33 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as an associated cluster tied (via an initial access broker) to Yanluowang-related activity; specific operations/TTPs are not detailed in this content beyond the stated linkage.
Financially motivated intrusion activity consistent with an initial access broker: vishing/MFA fatigue to obtain VPN access, enrollment of new MFA devices, privilege escalation to admin, extensive credential dumping (NTDS/SAM/LSASS), lateral movement via RDP/Citrix, log clearing/defense evasion, limited exfiltration (Box folder + AD auth data), and repeated re-entry attempts post-eviction. Content notes historical linkage to ransomware operations and double-extortion tradecraft, though no ransomware was deployed in this incident.
Financially motivated intrusion activity consistent with an initial access broker: vishing/MFA fatigue to obtain VPN access, enrollment of new MFA devices, privilege escalation to admin, extensive credential dumping (NTDS/SAM/LSASS), lateral movement via RDP/Citrix, log clearing/defense evasion, limited exfiltration (Box folder + AD auth data), and repeated re-entry attempts post-eviction. Content notes historical linkage to ransomware operations and double-extortion tradecraft, though no ransomware was deployed in this incident.
Affiliate associated with FiveHands ransomware campaigns using SonicWall exploits and the tracked Cobalt Strike infrastructure.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.