Loading threat actor…
UNK_GreenSec is a threat cluster linked to TransferLoader malware and assessed to have strong ties to Russia-linked intrusion activity. It has been associated with phishing and social-engineering campaigns that use decoy documents, fake NDA-themed lures, and related delivery tradecraft to infect victims. The cluster has also been connected to the ZipLine campaign, which used contact-form outreach and fake business documents to deliver malware to supply-chain-relevant organizations. TransferLoader is the malware family most consistently associated with UNK_GreenSec. It functions as a loader with downloader and backdoor capabilities and has been used to deepen compromise after initial access, mask malicious execution behind decoy document display, and deliver additional payloads. Reported follow-on payloads include backdoors and ransomware, including Morpheus and Metasploit ransomware. UNK_GreenSec activity has also been linked through infrastructure overlap and shared techniques with TA829, the Russia-linked operation commonly associated with RomCom. Shared tradecraft reported across these clusters includes use of proxy infrastructure, SSH tunneling utilities, and hosted utilities, suggesting either a shared infrastructure provider or a closer operational relationship. Victimology linked to UNK_GreenSec includes organizations in Ukraine and Poland in broader campaigns involving related malware ecosystems, as well as U.S.-based victims and supply-chain-critical sectors in the United States, Singapore, Japan, and Switzerland. Reported targeted sectors include industrial manufacturing, semiconductors, consumer goods, biotechnology, and pharmaceuticals. The cluster’s operations span espionage-adjacent intrusion behavior and financially motivated post-compromise activity, with ransomware deployment observed through TransferLoader infections. High-confidence behaviors associated with UNK_GreenSec include initial access via phishing or social-engineering lures, reconnaissance and backdoor activity through associated malware, persistence and post-exploitation through follow-on payload delivery, defense evasion through stealthy loaders and decoy document execution, and exfiltration-capable access via linked backdoors. The cluster is best characterized as a Russia-linked intrusion set operating at the boundary between cybercrime and state-aligned tradecraft.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
7 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Previously reported activity using fake NDA documents to deliver the MixShell backdoor; mentioned here as a TTP overlap comparison rather than as the actor behind the current campaign.
Activity cluster delivering TransferLoader; assessed to share tactics/infrastructure with TA829/RomCom activity.
Mentioned only as an overlapping activity cluster with RomCom (shared elements implied), but the content does not provide specific independent TTPs, targeting, or tooling beyond the stated overlap.
UNK_GreenSec is a threat actor cluster linked to the ZipLine campaign, targeting supply chain-critical industries with in-memory malware and advanced social engineering.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.