Loading threat actor…
UNG0801 is a threat cluster associated with Operation IconCat, a campaign primarily targeting organizations in Israel. The activity has been assessed as likely originating from Western Asia, although definitive attribution remains unresolved. The cluster has been observed targeting enterprise environments, particularly organizations in information technology, managed service provider, human resources, and software development roles. UNG0801 relies heavily on social engineering for initial access, using Hebrew-language phishing lures crafted to resemble routine internal business communications such as security advisories, compliance notices, and webinar announcements. A distinctive feature of the operation is the spoofing of trusted antivirus and security vendor branding, including the use of familiar product icons and visual themes to increase credibility and induce user execution. The cluster has been linked to at least two related operational waves with differing objectives but overlapping tradecraft. One wave delivered PYTRIC, a Python-based implant assessed as destructive and capable of wiping system data and deleting backups. Another wave delivered RUSTRIC, a Rust-based implant oriented toward espionage, including host and network reconnaissance, security product enumeration, and theft of sensitive information. The shared delivery patterns, timing, and antivirus-icon masquerading suggest a common operator or closely related activity set. Observed techniques include phishing attachments and links for initial access, user-execution dependency, macro-based execution, scripting, WMI use, masquerading, obfuscation, reconnaissance, and data exfiltration. The actor demonstrates moderate sophistication and persistence, combining low-cost or repurposed infrastructure with effective deception tailored to Israeli enterprise users. Overall, UNG0801 is best characterized as a Western Asia-linked espionage-focused cluster that has also demonstrated destructive capability.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cyber-espionage cluster targeting organizations in Israel, originating from Western Asia.
UNG0801 is a threat cluster targeting Israeli IT, MSP, HR, and software development sectors with phishing lures in Hebrew, delivering custom Python and Rust-based malware (PYTRIC and RUSTRIC) for system reconnaissance and potential data wiping.
Cyber-espionage/sabotage cluster targeting Israeli organizations by spoofing trusted antivirus vendor branding (notably SentinelOne and Check Point) to deliver malware via Hebrew-language phishing lures. Two linked waves: one deploying a destructive wiper (PYTRIC) and another deploying an espionage implant (RUSTRIC) for data theft; both share an AV-icon abuse playbook and overlapping infrastructure/signing-certificate artifacts (e.g., certificates tied to netvigil.org).
UNG0801 is a threat activity cluster targeting Israeli organizations, primarily in the IT, HR, and technology sectors, using spear-phishing campaigns with malicious PDF and Word documents. The campaigns are characterized by the spoofing of antivirus vendor icons (Check Point and SentinelOne) to increase legitimacy. Two main malware implants are used: PYTRIC (a PyInstaller-packed Python wiper) and RUSTRIC (a Rust-based espionage tool). The group employs social engineering, AV icon spoofing, and custom malware for both destructive and espionage purposes.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.