UNC4487
No sourced public emblem in this profile.
reference profile · reported nexus: Unknown (not nationality)
UNC4487 is a threat actor that targeted Ukrainian government officials by compromising a Ukrainian auto insurance website essential for official travel. This attack facilitated the distribution of the MATANBUCHUS malware, which was used to monetize access to infected systems. Mandiant later identified additional malware samples, referred to as ChillyHell, linked to UNC4487 through the reuse of a code signing certificate associated with MATANBUCHUS. The group's activities highlight a focus on exploiting critical infrastructure for financial gain.
Source-reported aliases: . Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://www.jamf.com/blog/chillyhell-a-modular-macos-backdoor/