# UNC3890: threat group profile

> UNC3890 is a threat group thought to operate from Iran. Public reporting about it is still limited. This free profile brings together what is known about it, so you can judge the risk to you. It lists the other names the group goes by and links to every public report behind it.

Canonical page: https://www.edgeprotect.io/threat-actors/unc3890
Breadcrumb: [Home](https://www.edgeprotect.io/) > [Threat groups](https://www.edgeprotect.io/threat-actors) > UNC3890

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 0 |
| Thought to operate from | Iran |
| Other names | 0 |
| Public reports | 2 |

## Who is UNC3890?

UNC3890 is a threat group thought to operate from Iran. Public reporting about it is still limited.

### What public reporting says

> A suspected Iranian threat activity cluster has been linked to attacks aimed at Israeli shipping, government, energy, and healthcare organizations, in a campaign stretching back to late 2020. Researchers believe that the data harvested during the campaign could be used to support various activities. UNC3890, the threat actor behind the attacks, deployed two proprietary pieces of malware – a backdoor named “SUGARUSH” and a browser credential stealer called “SUGARDUMP”, which exfiltrates password information to email addresses registered with Gmail, ProtonMail, Yahoo and Yandex email services. The threat actor also employs a network of C&C servers that host fake login pages impersonating legitimate platforms such as Office 365, LinkedIn and Facebook. These servers are designed to communicate with the targets and also with a watering hole hosted on the login page of a legitimate Israeli shipping company.

## Public reports about UNC3890

- https://ics-cert.kaspersky.com/publications/reports/2023/03/24/apt-attacks-on-industrial-organizations-in-h2-2022/
- https://www.mandiant.com/resources/suspected-iranian-actor-targeting-israeli-shipping

## Frequently asked questions

### Who is UNC3890?

UNC3890 is a threat group thought to operate from Iran. Public reporting about it is still limited.

### Where is UNC3890 thought to be based?

Public reporting places UNC3890 as operating from Iran. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### How do I know if UNC3890 is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free EdgeProtect account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.edgeprotect.io/register
- Book a demo: https://www.edgeprotect.io/contact