Loading threat actor…
UNKN is a name associated with two distinct cybercrime contexts and should be treated carefully to avoid conflation. In ransomware reporting, UNKN or Unknown has been identified as the actor behind the REvil ransomware-as-a-service platform, which emerged in 2019 and enabled affiliates to conduct intrusions and deploy Sodinokibi ransomware. In that role, UNKN functioned as a platform operator supporting affiliate activity rather than a single intrusion set. REvil operations were characterized by initial compromise of internet-facing systems, use of web shells and commercial post-exploitation tooling, credential theft, privilege escalation, internal reconnaissance, lateral movement, persistence, pre-encryption data exfiltration, and enterprise-wide ransomware deployment. REvil also used extortion based on stolen data and operated a leak-site model. Separately, UNKN has also been used as the name of one of several botnets distributing the Medusa Android banking trojan, also known as TangleBot. In that context, UNKN refers to a distinct cluster of threat actors focused primarily on European targets, especially France, Italy, Spain, and the United Kingdom. These campaigns used smishing and malicious Android dropper applications to deliver Medusa. The malware supports keylogging, screen control, SMS abuse, overlay-based fraud, screenshot capture, and other on-device theft functions through abuse of Android accessibility features. Because the same label is used for both the REvil platform operator and a Medusa-distributing botnet cluster, attribution under the name UNKN is ambiguous unless the surrounding campaign context is specified. Across both usages, the activity is consistent with financially motivated cybercrime.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
23 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A distinct threat actor cluster operating a Medusa-associated botnet that delivers malicious Android dropper apps and focuses on European targets, especially France, Italy, Spain, and the UK.
Operator identified as creating the REvil ransomware-as-a-service platform and recruiting affiliates.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.