UNC4841
UNC4841 is classified as state-sponsored.
- Origin
- China
- Also known as
- 1
UNC4841 is a well-resourced threat actor that has utilized a wide range of malware and purpose-built tooling to enable their global espionage operations. They have been observed selectively deploying specific malware families at high priority targets, with SKIPJACK being the most widely deployed. UNC4841 primarily targeted government and technology organizations, but they have also been observed targeting other verticals.
The group's reported origin is China.
Also known as: SLIME57
Published reports on this actor:
- https://cloud.google.com/blog/topics/threat-intelligence/unc4841-post-barracuda-zero-day-remediation/
- https://cloud.google.com/blog/topics/threat-intelligence/barracuda-esg-exploited-globally/
- https://i.blackhat.com/Asia-24/Presentations/Asia-24-Chen-Chinese-APT.pdf
Source: MISP Galaxy, Malpedia.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.