UNC5142

UNC5142 is a financially motivated cybercriminal threat cluster associated with the ClearFake/CLEARSHORT ecosystem and known for large-scale compromise of vulnerable WordPress websites to distribute information-stealing malware. The group has been active since at least 2023 and is notable for pioneering the use of EtherHiding, a blockchain-backed delivery and control technique that uses smart contracts on BNB Smart Chain to store or resolve next-stage payload information. This architecture gives the actor resilient, rapidly updateable infrastructure that is harder to disrupt than conventional domain-based command-and-control. UNC5142 typically compromises WordPress sites by injecting malicious JavaScript into plugins, themes, or site databases, then presents social-engineering lures such as fake browser updates or ClickFix-style prompts that trick visitors into executing malicious commands. The injected JavaScript framework, tracked as ClearFake and its evolved variant CLEARSHORT, acts as a multistage downloader that retrieves additional components from blockchain-linked infrastructure, often using public RPC services and legitimate Web3 libraries. Reporting indicates the actor evolved from simpler single-contract designs to a multi-contract proxy-style architecture that separates stable routing logic from replaceable payload components, enabling rapid campaign updates without reinfecting compromised sites. The cluster has distributed multiple infostealers, including Lumma, Vidar, Rhadamanthys, and Atomic macOS Stealer, and has targeted both Windows and macOS users. Observed tradecraft includes initial access through compromised websites, credential theft and cryptocurrency-focused theft via delivered stealers, reconnaissance and persistence in follow-on payload chains, and defense evasion through obfuscation, encryption, in-memory execution, and abuse of trusted platforms and decentralized infrastructure. UNC5142 has also been linked to broad use of ClickFix lures and fake Chrome update prompts to induce user execution. Google Threat Intelligence Group tracked roughly 14,000 compromised web pages associated with UNC5142 by mid-2025, indicating substantial scale. The activity appears opportunistic at the website-compromise stage, with vulnerable WordPress sites targeted indiscriminately, while end-user victims are exposed through traffic to those compromised sites. UNC5142 is widely characterized as a cybercriminal actor rather than a state-sponsored group, and its dominant objective is theft of credentials, financial data, and cryptocurrency-related assets.