Loading threat actor…
UNC2420 is a financially motivated cybercrime threat cluster associated with large-scale phishing-driven malware distribution and publicly overlapping with Shathak and TA551. The actor is known for operating email-based delivery chains that used malicious document lures and staged downloaders to install follow-on payloads, including PHOTOLOADER and ICEDID. Between mid and late 2020, UNC2420 was attributed with distributing MOUSEISLAND, a macro-enabled downloader delivered through phishing attachments, which then led to additional malware installation. UNC2420 functions primarily as an access-enablement and malware distribution actor rather than the final ransomware operator in the observed activity. Its intrusion role centered on initial access through phishing and malware delivery, with downstream access later used by other financially motivated clusters for post-exploitation and ransomware deployment. In multiple investigated intrusions, access originating from UNC2420’s distribution chain was subsequently leveraged by UNC2198, which used ICEDID-derived footholds for broader compromise, data theft, and deployment of MAZE and later EGREGOR ransomware. High-confidence reporting links UNC2420 to phishing-based initial access and malware staging activity consistent with a cybercrime ecosystem in which specialized actors provide footholds for follow-on monetization. Known aliases include Shathak and TA551.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.