UNC4393
No sourced public emblem in this profile.
reference profile · reported nexus: Unknown (not nationality)
UNC4393 is a financially motivated threat actor primarily using BASTA ransomware. They have been active since early 2022 and have targeted over 40 organizations across various industries. UNC4393 has shown a willingness to cooperate with other threat clusters for initial access and has evolved from using existing tools to developing custom malware. They focus on efficient data exfiltration and multi-faceted extortion, often utilizing tools like COGSCAN and RCLONE for reconnaissance and data theft.
Source-reported aliases: Storm-1811, CURLY SPIDER, STAC5777, Cardinal. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://cloud.google.com/blog/topics/threat-intelligence/unc4393-goes-gently-into-silentnight
https://www.security.com/threat-intelligence/black-basta-ransomware-zero-day
https://redcanary.com/blog/threat-intelligence/storm-1811-black-basta/
https://redcanary.com/blog/threat-intelligence/intelligence-insights-june-2024/
https://x.com/MsftSecIntel/status/1881751635598139714
https://services.google.com/fh/files/misc/m_trends_2023_report.pdf
https://services.google.com/fh/files/misc/m-trends-2024.pdf
https://x.com/Unit42_Intel/status/1880368272610050459
https://medium.com/walmartglobaltech/qbot-is-back-connect-2d774052369f
https://go.crowdstrike.com/rs/281-OBQ-266/images/CrowdStrikeGlobalThreatReport2025.pdf
https://www.crowdstrike.com/adversaries/curly-spider/