Loading threat actor…
UNC2198 is a financially motivated intrusion cluster associated with ransomware monetization following ICEDID-enabled initial access. The cluster has been observed targeting organizations in North America across multiple industries and conducting rapid post-compromise operations that culminate in deployment of MAZE and later EGREGOR ransomware. Activity attributed to UNC2198 overlaps with access obtained through phishing distribution chains linked to UNC2420, also publicly tracked as Shathak or TA551. UNC2198 has used ICEDID infections as an entry point and then deployed a broad post-exploitation toolkit including Cobalt Strike BEACON, SYSTEMBC, WINDARC, Metasploit METERPRETER, KOADIC, and PowerShell EMPIRE. The group performs extensive internal reconnaissance and Active Directory mapping, including use of BloodHound and standard administrative discovery commands. Observed lateral movement methods include WinRM, RDP, and remote service execution. In at least one intrusion, UNC2198 used SOURBITS to exploit CVE-2020-0787 for privilege escalation. The cluster has demonstrated strong capability in defense evasion and operational scaling, including use of droppers, BITS jobs, remote PowerShell retrieval of tooling, and rapid propagation across victim environments. Prior to ransomware deployment, UNC2198 has exfiltrated large volumes of victim data using RCLONE, indicating double-extortion tradecraft. Reported operations showed a transition from MAZE to EGREGOR in late 2020, consistent with affiliate-style ransomware monetization. Related activity previously tracked as UNC2374 and UNC2414 was later merged into UNC2198 based on shared infrastructure and tooling characteristics, indicating these designations represented closely related or overlapping operations rather than distinct long-term actors.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
19 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
10 malware families attributed to this actor across reporting.
5 additional families tracked in Mallory.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
37 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.