UNC4393 is a financially motivated threat cluster that leveraged QAKBOT infections to deploy BEACON and ultimately the BASTA ransomware, targeting hundreds of victims across multiple industries. The group has evolved from using readily available tools to developing custom malware (DAWNCRY, KNOTWRAP, KNOTROCK, PORTYARD, COGSCAN) and diversified its initial-access methods, all while maintaining a rapid operational tempo. #UNC4393 #BASTA #QAKBOT #SILENTNIGHT #KNOTWRAP #PORTYARD #DAWNCRY #COGSCAN
Keypoints
- Mandiant detected 40+ UNC4393 intrusions across 20 industry verticals, with healthcare breaches indicating possible expansion.
- UNC4393 is the primary user of BASTA ransomware, claimed to have 500+ victims on the BASTA DLS.
- The group shifted from readily available tools to custom malware (e.g., DAWNCRY, KNOTWRAP, KNOTROCK, PORTYARD, COGSCAN).
- Initial access frequently comes from QAKBOT infections via phishing, with HTML smuggling used to deliver payloads.
- UNC4393 operates under a private affiliate model for deploying BASTA, rather than traditional public RaaS.
- Malware observed includes BASTA, SYSTEMBC, KNOTWRAP, KNOTROCK, DAWNCRY, PORTYARD, and COGSCAN, among others.
MITRE Techniques
- [T1566] Phishing – Initial access via phishing emails delivering QAKBOT payloads. Quote: “Phishing: Technique ID: T1566”
- [T1059] Command-Line Interface – Execution via command-line to run or drop payloads. Quote: “Command-Line Interface: Technique ID: T1059”
- [T1203] Malicious File – Execution by dropping or executing a malicious file. Quote: “Malicious File: Technique ID: T1203”
- [T1547] Registry Run Keys / Startup Folder – Persistence by registry-based startup execution. Quote: “Registry Run Keys / Startup Folder: Technique ID: T1547”
- [T1203] Exploitation for Client Execution – Privilege escalation through exploitation techniques. Quote: “Exploitation for Client Execution: Technique ID: T1203”
- [T1027] Obfuscated Files or Information – Defense evasion via obfuscated components. Quote: “Obfuscated Files or Information: Technique ID: T1027”
- [T1003] Credential Dumping – Credential access via credential dumping. Quote: “Credential Dumping: Technique ID: T1003”
- [T1046] Network Service Scanning – Discovery by scanning network services. Quote: “Network Service Scanning: Technique ID: T1046”
- [T1021] Remote Services – Lateral movement via remote services (e.g., SMB, RDP). Quote: “Remote Services: Technique ID: T1021”
- [T1213] Data from Information Repositories – Data collection from information repositories. Quote: “Data from Information Repositories: Technique ID: T1213”
- [T1041] Exfiltration Over C2 Channel – Exfiltration conducted over C2 channel. Quote: “Exfiltration Over Command and Control Channel: Technique ID: T1041”
- [T1486] Data Encrypted for Impact – Data encryption for impact as part of ransomware. Quote: “Data Encrypted for Impact: Technique ID: T1486”
- [T1071.004] Application Layer Protocol: DNS – DNS-based C2 beacons and malleable profiles. Quote: “DNS beacons and listeners can be customized… Malleable C2 profiles.”
Indicators of Compromise
- [IP Address] – 179.60.149.235 – Example download URL in certutil-based delivery: http://179.60.149.235/KineticaSurge.dll
- [File Hash] – 3f400f30415941348af21d515a2fc6a3, 56c1a45c762a29fe6080788f85e6cfc3
- [File Name] – BASTA_Ransomware.exe, KineticaSurge.dll
- [File Name] – KineticaSurge.dll (from certutil drop/download workflow)
- [Domain] – h.dns.[C2 Domain], ridoj4.[8 character string].dns.[C2 Domain]
- [URL] – https://basta (referenced in YARA rules and BASTA-related indicators)
Read more: https://cloud.google.com/blog/topics/threat-intelligence/unc4393-goes-gently-into-silentnight/