Loading threat actor…
UNC2465 is a financially motivated cybercrime threat cluster active since at least 2019 and widely associated with ransomware affiliate operations. The actor has been linked to the deployment of DARKSIDE and later LOCKBIT, and has also been described as participating in hybrid ransomware and data-leak extortion activity. UNC2465 is best known for using the SMOKEDHAM backdoor as a central access and post-compromise tool. UNC2465 has used multiple initial-access methods, including phishing and trojanized software installers distributed through supply-chain compromise and malvertising. Observed lures have impersonated legitimate administrative and security-related software. In several intrusions, the actor used DLL sideloading and PowerShell-based execution chains to install SMOKEDHAM and establish persistence. SMOKEDHAM is a lightweight .NET backdoor used by UNC2465 to execute arbitrary commands, run PowerShell, collect host reconnaissance, support keylogging and screen capture, and maintain durable access. UNC2465 has paired SMOKEDHAM with legitimate remote-access and tunneling utilities, especially NGROK, to expose internal services and bypass perimeter controls. The actor has also used UltraVNC, reverse SSH tunneling, RDP, Splashtop, Cobalt Strike, keyloggers, and credential-harvesting techniques including LSASS dumping. Post-compromise activity attributed to UNC2465 includes reconnaissance with tools such as Advanced IP Scanner and BloodHound, credential theft with Mimikatz and memory dumping, lateral movement via RDP, WMI, and PsExec, and persistence through Run keys, startup items, scheduled or service-based mechanisms, and abuse of legitimate software components. The actor has also been observed targeting backup platforms, deleting backup routines, erasing data, and modifying permissions to inhibit recovery before ransomware deployment. UNC2465 has conducted data exfiltration prior to encryption and is associated with double-extortion tradecraft. In observed enterprise intrusions, the actor archived file shares, exfiltrated data with common transfer tools, and then deployed ransomware against virtualized infrastructure, including VMware ESXi environments. Related operations have involved delayed execution, remote administration of hypervisor hosts, and encryption of virtual machine assets. Known reporting consistently characterizes UNC2465 as a ransomware affiliate cluster rather than a nation-state actor. The group’s behavior reflects profit-driven intrusion operations focused on gaining access, stealing credentials and data, moving laterally to high-value systems, impairing recovery, and monetizing victims through extortion and ransomware deployment.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
36 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 malware families attributed to this actor across reporting.
30 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named RaaS affiliate mentioned because prior reporting linked it to use of SMOKEDHAM; the article speculates but does not confirm any current affiliation with Hunters International.
Financially motivated intrusion activity leveraging the SMOKEDHAM backdoor for initial access, persistence, reconnaissance, lateral movement, and subsequent extortion/ransomware deployment; historically linked to DARKSIDE and later shifting to LOCKBIT.
UNC2465 is a DARKSIDE ransomware affiliate known for conducting supply chain attacks, specifically by Trojanizing software installers on legitimate websites to gain initial access. They use a variety of malware and tools for persistence, lateral movement, credential harvesting, and remote access, and have demonstrated the ability to switch between different ransomware and malware offerings as affiliate programs change.
DarkSide-linked cluster that uses phishing to deliver Smokedham and later deploys DarkSide ransomware, with long dwell times and use of tunneling utilities to expose remote desktop services.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.