UNC4393 is a threat actor, also known as Storm-1811, Cardinal, STAC5777. This group is tracked in the Strobes VI threat intelligence database.

What vulnerabilities does UNC4393 exploit?

UNC4393 is known to exploit 3 CVEs. View the full list on the Strobes VI threat actor profile page.

Agentic AI · Pentesting

Ready for Agentic Automated Testing?

Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.

Zero false positives

PoC for every finding

30+ tools orchestrated

Book a Demo Learn More

Setup in 5 minutesSOC 2 & ISO 27001

UNC4393

Also known as: Storm-1811, Cardinal, STAC5777, CURLY SPIDER

Financial Gain

Exploited CVEs

Overview

UNC4393 is a financially motivated threat actor primarily using BASTA ransomware. They have been active since early 2022 and have targeted over 40 organizations across various industries. UNC4393 has shown a willingness to cooperate with other threat clusters for initial access and has evolved from using existing tools to developing custom malware. They focus on efficient data exfiltration and multi-faceted extortion, often utilizing tools like COGSCAN and RCLONE for reconnaissance and data theft.

Exploited Vulnerabilities

CVE ID	Action
CVE-2024-1708	View Details