- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Unknown
- Sources
- 3 sources carry it
- Identifier
- GINC-APT-1054 · ung0901
What it is
UNG0901 is a cyber-espionage threat actor targeting Russian entities, particularly in the aerospace and defense sectors, utilizing spear-phishing tactics. They deploy the EAGLET backdoor, which exhibits functionalities similar to the Golang-based PhantomDL used by the Head Mare group, including shell, download, and upload capabilities. Notable overlaps in file-naming conventions and targeting strategies further reinforce the connection between UNG0901 and Head Mare.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Operations
- Operation CargoTalon
- Other names
- Unknown-Group-901
Tools
The tools and malware families the sources tie to it.
- Backdoor.Oldrea
- Cyber Eye RAT
- CyberGate
- SPACESHIP
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de