- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Italy(high confidence)
- Sources
- 3 sources carry it
- Identifier
- GINC-APT-1036 · unc4990
ItalyWhat it is
UNC4990 is a financially motivated threat actor that has been active since at least 2020. They primarily target users in Italy and rely on USB devices for initial infection. The group has evolved their tactics over time, using encoded text files on popular websites like GitHub and Vimeo to host payloads. They have been observed using sophisticated backdoors like QUIETBOARD and EMPTYSPACE, and have targeted organizations in various industries, particularly in Italy.
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Tools
The tools and malware families the sources tie to it.
- Backdoor.Oldrea
- SPACESHIP
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de