Other threat group

UNC5342

UNC5342 is classified as other threat group.

Type: Other threat group
Origin: North Korea

UNC5342 is a North Korea-linked APT that employs the EtherHiding technique to deliver malware and facilitate cryptocurrency theft. The actor has been observed deploying EtherRAT and JADESNOW malware, utilizing transaction history as a Dead Drop Resolver to embed payloads directly into the calldata of blockchain transactions. Their operations involve leveraging centralized API services to interact with public blockchains like Ethereum and BNB Smart Chain. The malware is designed to exfiltrate sensitive data, particularly targeting cryptocurrency wallets and credentials.

The group's reported origin is North Korea.

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.