Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.
Also known as: ITG23, Pistachio Tempest, UNC1878, Storm-0230, Grim Spider, DEV-0193, DEV-0237, Storm-0193, GOLD BLACKBURN, TEMP.MixMaster, FIN12, Periwinkle Tempest, Trickbot LLC, UNC2053, GOLD ULRICK
UNC1878 is a financially motivated threat actor that monetizes network access via the deployment of RYUK ransomware. Earlier this year, Mandiant published a blog on a fast-moving adversary deploying RYUK ransomware, UNC1878. Shortly after its release, there was a significant decrease in observed UNC1878 intrusions and RYUK activity overall almost completely vanishing over the summer. But beginning in early fall, Mandiant has seen a resurgence of RYUK along with TTP overlaps indicating that UNC1878 has returned from the grave and resumed their operations.
| CVE ID | Action |
|---|---|
| CVE-2020-1472 |
| CVE-2014-7169 | View Details |
| CVE-2017-0176 | View Details |
| CVE-2016-6662 | View Details |