UNC1878
No sourced public emblem in this profile.
reference profile · reported nexus: Unknown (not nationality)
UNC1878 is a financially motivated threat actor that monetizes network access via the deployment of RYUK ransomware. Earlier this year, Mandiant published a blog on a fast-moving adversary deploying RYUK ransomware, UNC1878. Shortly after its release, there was a significant decrease in observed UNC1878 intrusions and RYUK activity overall almost completely vanishing over the summer. But beginning in early fall, Mandiant has seen a resurgence of RYUK along with TTP overlaps indicating that UNC1878 has returned from the grave and resumed their operations.
Source-reported aliases: . Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://twitter.com/anthomsec/status/1321865315513520128
https://gist.github.com/aaronst/6aa7f61246f53a8dd4befea86e832456
https://www.youtube.com/watch?v=CgDtm05qApE
https://www.fireeye.com/blog/threat-research/2020/03/the-cycle-of-adversary-pursuit.html