216.73.217.22

UNC5342

· Published 21/12/2025 17:35 · Modified 21/12/2025 17:35 · Source: AlienVault

Essential information

Confidence
100/100
Published
21/12/2025 17:35
Modified
21/12/2025 17:35
Updated at
21/12/2025 17:35
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
13 attack patterns (mitre), 4 malware, 2 sectors, 2 indicators

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Attack patterns (MITRE) (13)

  • T1587.001 uses
    Malware
  • T1102.003 uses
    One-Way Communication
  • T1056.001 uses
    Keylogging
  • T1555 uses
    Credentials from Password Stores
  • T1059.007 uses
    JavaScript
  • T1573.001 uses
    Symmetric Cryptography
  • T1584 uses
    Compromise Infrastructure
  • T1114 uses
    Email Collection
  • T1027 uses
    Obfuscated Files or Information
  • T1140 uses
    Deobfuscate/Decode Files or Information
  • T1566 uses
    Phishing
  • T1005 uses
    Data from Local System
  • T1041 uses
    Exfiltration Over C2 Channel

Malware (4)

  • InvisibleFerret uses
    Family
    Published 21/04/2026 12:09 · Modified 21/04/2026 12:09
  • BeaverTail uses
    Family
    Published 21/04/2026 12:09 · Modified 21/04/2026 12:09
  • JADESNOW uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 20/12/2025 20:00 · Modified 21/12/2025 17:35
  • LUMASTEALER

Sectors (2)

  • Technology targets
  • Finance targets

Indicators (2)