[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnIF6YgicRGd7Rtsv2rlhYoH4yvVPsqvqYW3F6-V5OGk":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":13,"country":14,"suspected_sponsor":14,"target_industries":15,"target_countries":16,"incident_types":17,"references":18,"techniques":35,"technique_count":36,"created_at":37,"seoMetadata":38,"schemaOrg":42},"UNC4393","unc4393",[9,10,11,12],"Storm-1811","CURLY SPIDER","STAC5777","Cardinal","UNC4393 is a financially motivated threat actor primarily using BASTA ransomware. They have been active since early 2022 and have targeted over 40 organizations across various industries. UNC4393 has shown a willingness to cooperate with other threat clusters for initial access and has evolved from using existing tools to developing custom malware. They focus on efficient data exfiltration and multi-faceted extortion, often utilizing tools like COGSCAN and RCLONE for reconnaissance and data theft.",null,[],[],[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34],"https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Func4393-goes-gently-into-silentnight","https:\u002F\u002Fwww.security.com\u002Fthreat-intelligence\u002Fblack-basta-ransomware-zero-day","https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Fdetecting-disrupting-malvertising-backdoors\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2024\u002F05\u002F15\u002Fthreat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware\u002F","https:\u002F\u002Fnews.sophos.com\u002Fen-us\u002F2025\u002F01\u002F21\u002Fsophos-mdr-tracks-two-ransomware-campaigns-using-email-bombing-microsoft-teams-vishing\u002F","https:\u002F\u002Fwww.esentire.com\u002Fsecurity-advisories\u002Fongoing-email-bombing-campaigns-leading-to-remote-access-and-post-exploitation","https:\u002F\u002Fredcanary.com\u002Fblog\u002Fthreat-intelligence\u002Fstorm-1811-black-basta\u002F","https:\u002F\u002Fredcanary.com\u002Fblog\u002Fthreat-intelligence\u002Fintelligence-insights-june-2024\u002F","https:\u002F\u002Fx.com\u002FMsftSecIntel\u002Fstatus\u002F1881751635598139714","https:\u002F\u002Ftechcommunity.microsoft.com\u002Fblog\u002Fmicrosoftsecurityexperts\u002Fphish-click-breach-hunting-for-a-sophisticated-cyber-attack\u002F4267916","https:\u002F\u002Fservices.google.com\u002Ffh\u002Ffiles\u002Fmisc\u002Fm_trends_2023_report.pdf","https:\u002F\u002Fservices.google.com\u002Ffh\u002Ffiles\u002Fmisc\u002Fm-trends-2024.pdf","https:\u002F\u002Fx.com\u002FUnit42_Intel\u002Fstatus\u002F1880368272610050459","https:\u002F\u002Fmedium.com\u002Fwalmartglobaltech\u002Fqbot-is-back-connect-2d774052369f","https:\u002F\u002Fgo.crowdstrike.com\u002Frs\u002F281-OBQ-266\u002Fimages\u002FCrowdStrikeGlobalThreatReport2025.pdf","https:\u002F\u002Fwww.crowdstrike.com\u002Fadversaries\u002Fcurly-spider\u002F",[],0,"2024-08-20T01:15:07.824016+00:00",{"title":39,"metaDescription":40,"keywords":41},"UNC4393 Threat Actor Profile | EdgeProtect","UNC4393 is a financially motivated threat actor primarily using BASTA ransomware. They have been active since early 2022 and have targeted over 40 org...","UNC4393, Storm-1811, CURLY SPIDER, STAC5777, Cardinal, threat actor, APT, cyber threat, threat intelligence",{"@context":43,"@type":44,"name":6,"alternateName":45,"description":13,"url":46,"mainEntityOfPage":47},"https:\u002F\u002Fschema.org","Organization",[9,10,11,12],"http:\u002F\u002Flocalhost:3000\u002Fthreat-actors\u002Func4393",{"@type":48,"@id":46},"WebPage"]