Overview 620 indicators
No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.
| domain | 605 | UNC1151-domain.txt |
| url_path | 6 | UNC1151.json |
| ipv4 | 5 | UNC1151.json |
| url | 4 | UNC1151.json |
Principal sources 84 reports
Ranked by how many of this actor's indicators each report brought in.
- 161github.com/prodaft/malware-ioc/tree/master/UNC1151
- 98virustotal.com/gui/ip-address/46.23.109.83/relations
- 89content.fireeye.com/web-assets/rpt-unc1151-ghostwriter-upda…
- 89fireeye.com/blog/threat-research/2021/04/espionage-…
- 89otx.alienvault.com/pulse/6089a10aa27c23fdd4ee928e
- 29cert.gov.ua/article/1545776 (Ukrainian)
- 25virustotal.com/gui/ip-address/208.91.197.91/relations
- 24cert.gov.ua/article/40263 (Ukrainian)
Related groups 3
What the sources have in common — not a claim that these are the same actor. See the whole graph.
Timeline 620 indicators
Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.
Showing the 300 most recent of 620. Complete: UNC1151.json.
No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.
-
a1si.icu a3ufz.xsjdsb.icu advancedaisolutionsforeveryone.a1si.icu alertapp.icu alerteddatalistsclients.alertapp.icu cgdirector.icu productionsamplesoftheyear.cgdirector.icu xsjdsb.icu -
x.com/smica83/status/2054518692298273011 · x.com/malwrhunterteam/status/2054858213439250… · welivesecurity.com/en/eset-research/frostyneighbor-fresh-m… · tria.ge/260513-m7anjahw5v/behavioral1
alexavegas.icu algsat.icu attachment-storage-asset-static.needbinding.icu best-seller.lavanille.buzz book-happy.needbinding.icu easiestnewsfromourpointofview.algsat.icu hinesafar.sardk.icu ifo-jupyter.natter.icu lavanille.buzz mickeymousegamesdealer.alexavegas.icu nama-belakang.nebao.icu natter.icu nebao.icu needbinding.icu sardk.icu shinesafar.sardk.icu -
harfanglab.io/insidethelab/uac-0057-pressure-ukraine-… · github.com/HarfangLab/iocs/blob/main/TRR250801/trr…
curseforge.icu kitchengardenseeds.icu medpagetoday.icu pesthacks.icu punandjokes.icu sweetgeorgiayarns.online taskandpurpose.icu -
sentinelone.com/labs/ghostwriter-new-campaign-targets-u…
americandeliriumsociety.shop cookingwithbooks.shop everythingandthedog.shop pigglywigglystores.shop sciencealert.shop -
x.com/malwrhunterteam/status/1909235735850279… · x.com/malwrhunterteam/status/1909280553821741… · virustotal.com/gui/file/146df172a08f3b8bec4d5e2f3ac552…
rustyquill.top -
github.com/PaloAltoNetworks/Unit42-timely-threat-i…
agelessinvesting.xyz -
x.com/BushidoToken/status/1816766449102225854 · virustotal.com/gui/collection/2aa6b36a717be8bc49f79254…
bryndonovan.shop chaptercheats.shop clairedeco.shop connecticutchildrens.shop disneyfoodblog.shop eartheclipse.shop foampartyhats.shop ikitas.shop jackbenimblekids.shop kingarthurbaking.shop lansdownecentre.shop medicalnewstoday.shop moonlightmixes.shop penandthepad.shop petapixel.fun physio-pedia.shop semanticscholar.shop twisterplussize.shop utahsadventurefamily.shop weavesilk.space -
cert.gov.ua/article/6280159 · virustotal.com/gui/file/02d15669996853594424e5e7f957e1… · virustotal.com/gui/file/2cde8de330a874020340f2110bd1fd…
backstagemerch.shop empoweringparents.shop lauramcinerney.shop -
twitter.com/StopMalvertisin/status/1697175561339306… · cert.gov.ua/article/5661411 (# UAC-0057) · app.validin.com/axon?type=dom&zone_filter=pw&limit=1000… · virustotal.com/gui/ip-address/62.3.12.123/relations · virustotal.com/gui/file/f3d8c34443457d32de3c2687619037…
funwithme.pw officevibe.pw topibuzz.space -
twitter.com/StopMalvertisin/status/1697175561339306… · cert.gov.ua/article/5661411 (# UAC-0057) · app.validin.com/axon?type=dom&zone_filter=pw&limit=1000… · virustotal.com/gui/ip-address/62.3.12.123/relations · virustotal.com/gui/file/f3d8c34443457d32de3c2687619037…
windacarmelita.pw -
threatfox.abuse.ch/browse/tag/UNC1151
kurioworld.gq -
blog.talosintelligence.com/malicious-campaigns-target-entities-in-… · raw.githubusercontent.com/Cisco-Talos/IOCs/main/2023/07/malicious… · virustotal.com/gui/ip-address/94.131.108.109/relations
carpetmarker.pw everything-everywhere.at.ply.gg frivol.space hssenglish.pw kebhana.site mingxing.pw sellmyhousequickly.website simplifymedia.pw wordrow.website wuzhenfestival.site -
cert.gov.ua/article/4905718 (Ukrainian) · virustotal.com/gui/file/35d1e819d2ac2535f0aa9e22945701…
bourns.space yotsubasociety.website -
blog.google/threat-analysis-group/ukraine-remains-r… · otx.alienvault.com/pulse/64403596d7a47d80451657c3
meta-l.space passport-log.online passport-ua.site -
github.com/prodaft/malware-ioc/tree/master/UNC1151
account-login.top account-noreply.space account-passports.top accounts-gmail.com-check.online accounts-gmail.com-login.space accounts-login.top accounts-mail.site accounts-passport.top accounts-secure.com-firewall.online accounts-verify.space accounts.safe-mail.space accounts.secure-ua.site accounts.verify-email.space acount-pasport.site acount-passport.site bezpieczenstwo-danych.website bhwbehb.wecwe.com bokinteria.pl-kontrola-bezpieczenstwa.space bokinteria.weryfikacja-konta.pw com-firewall.online com-login.space com-verificate.top com-verification.online confirm.acount-pasport.site confirm.id-bigmir.site cookie-firewall.com-login.space dentyfikacja-uzytkownika.space departament-bezpieczenstwa.space dzial-bezpieczenstwa.space exprentis.com google.accounts.verify.no-reply.space google.com-firewall.online google.verifyprofiles.space group-rambler.site grupa-mailowa.weryfikacja-konta.link grupa-pocztowa.online i-ua.ml i-ua.space i.ua-login.top i.ua-passport.site iat.com.ua id-bigmir.site id-mail.site id.verify-mail.space identyfikacja-uzytkownika.link interia.pl-identyfikacja-uzytkownika.pw interia.poczta-mailowa.top interia.weryfikacja-poczty.space interia.weryfikacja-uzytkownika.site interii.konto-verify.space kemda.eu konto-onet.site konto.weryfikacja-uzytkownika.link konto.weryfikacja-uzytkownika.online konto.weryfikacja-uzytkownika.pw kontrola-bezpieczenstwa.link kontrola-bezpieczenstwa.pw kontrola-bezpieczenstwa.site kontrola-bezpieczenstwa.top kontrola-bezpieczenstwa.walidacja-uzytkownika.pw kontrola-konta.online kontrola-mailowa.top kontrola-poczty.link kontrola-poczty.pw krebas.lt login.meta-ua.top login.passport-verify.top login.verification-email.space login.verify-mail.space logowanie.identyfikacja-uzytkownika.link logowanie.kontrola-poczty.link mail-profiles.space mail.mil-gov.space meta-log.site meta-ua.top no-replay.space no-reply.accounts-verify.space no-reply.space no-reply.verifyprofiles.space okonto.kontrola-bezpieczenstwa.pw okonto.kontrola-poczty.pw passport-login.top passport-verify.top passport.i-ua.space passport.login-verify.top passport.meta-log.site passport.meta-ua.top passport.secure-ua.pw passport.secure-ua.space passportlogin.top pis.kontrola-bezpieczenstwa.site pl-identyfikacja-uzytkownika.pw pl-kontrola-bezpieczenstwa.space plklll.site poczta-mailowa.top poczta.bezpieczenstwo-danych.website poczta.departament-bezpieczenstwa.space poczta.identyfikacja-uzytkownika.space poczta.kontrola-bezpieczenstwa.link poczta.kontrola-bezpieczenstwa.top poczta.kontrola-konta.online poczta.kontrola-mailowa.top poczta.safe-onet.space poczta.sprawdzanie-zabezpieczen.space poczta.walidacja-konta.site poczta.walidacja-uzytkownika.pw poczta.weryfikacja-okonto.online poczta.weryfikacja-okonto.site poczta.wp-firewall.website pomoc.sprawdzanie-zabezpieczen.space pomoc.weryfikacja-okonto.online post.verify-mail.space potwierdzenie.konto-onet.site profiles-login.top rambler.account-noreply.space rtrrsfgsfg.site rwegfwfe.site safe-mail.space safe-onet.space sdfavavvvv.site secure-ua.pw secure-ua.site security.passportlogin.top service.kontrola-poczty.space sprawdzanie-zabezpieczen.space system-pocztowy.space system.walidacja-konta.link system.walidacja-konta.pw taysbb.ru ubsbha.ru ukr.account-login.top usluga.kontrola-poczty.top veirfy-ua.space verify.account-login.top verify.accounts-login.top verify.accounts-mail.site verify.accounts-passport.top verify.acount-passport.site verify.group-rambler.site verify.mail-profiles.space verify.no-replay.space verify.passport-login.top verify.passportlogin.top verify.profiles-login.top verifyprofiles.space walidacja-konta.link walidacja-konta.pw walidacja-konta.site walidacja-uzytkownika.pw weryfikacja-konta.link weryfikacja-konta.pw weryfikacja-okonto.online weryfikacja-okonto.site weryfikacja-uzytkownika.link weryfikacja-uzytkownika.online weryfikacja-uzytkownika.pw weryfikacja.system-pocztowy.space wirtualna.grupa-pocztowa.online wojskowa.akademia-mil.space wp-firewall.website -
github.com/prodaft/malware-ioc/tree/master/UNC1151 · threatfox.abuse.ch/browse/tag/UNC1151
kurioworld.cf -
virustotal.com/gui/ip-address/46.23.109.83/relations
ams-gos.top bel-oprosov.top belaru-opros.top bell-gos.club bild-gos.club bind-gos.cc biz-gos.top boom-gos.club cheap-gos.club ci-uah.xyz compensatia.top dess-opros.top dopomog-uah.top dopomog-ukr.top ever-gos.top farm-opros.top fear-gos.top filial-ukr.top fuz-opros.top gen-gos.top gigs-gos.top good-opros.top gos-kiev.top green-gos.club ili-gos.top ind-gos.top inv-gos.top it-opros.top jez-ukr.top junior-gos.club kont-gos.top lin-gos.top los-gos.top payeurope.top payform.top paysys.top poland-survey.top pollsk-surv.top polsk-pay.top poslugi-online.top poslugi-ukr.top pub-gos.top rb-vopros.top rbi-opros.top rbj-survey.top rbq-opros.top rbs-opros.top rbt-opros.top sio-gos.top state-uah.top subo-ukr.top ti-opros.top trust-gos.top uah-sitez.top ukr-compens.top ukr-dopomog.top ukr-uslugi.top yes-uah.top · 1 more in this batch, in the JSON
Further reading 84
- proofpoint.com/us/blog/threat-insight/asylum-ambuscade…
- twitter.com/threatinsight/status/1497355737844133895
- twitter.com/threatinsight/status/1497355994543779844
- virustotal.com/gui/file/a7b7a7bfc7d0a41436596795bf7da8…
- virustotal.com/gui/file/2cde8de330a874020340f2110bd1fd…
- cert.gov.ua/article/6280159
- virustotal.com/gui/ip-address/159.65.18.143/relations
- twitter.com/bread08/status/1497200607282798601
- twitter.com/StopMalvertisin/status/1697175561339306…
- virustotal.com/gui/ip-address/185.175.158.27/relations
- twitter.com/James_inthe_box/status/1231247315672809…
- blog.google/threat-analysis-group/tracking-cyber-ac…
- cert.gov.ua/article/40263 (Ukrainian)
- threatfox.abuse.ch/browse/tag/UNC1151
- twitter.com/cybercdh/status/1497486233743863812
- app.validin.com/axon?type=dom&zone_filter=pw&limit=1000…
- twitter.com/jaimeblascob/status/1497258705984835591
- twitter.com/idclickthat/status/1567889191333158912
- github.com/stamparm/maltrail/pull/9325/commits/9fe…
- sentinelone.com/labs/ghostwriter-new-campaign-targets-u…
- virustotal.com/gui/file/7f0511b09b1ab3a64c8827dd8af017…
- welivesecurity.com/en/eset-research/frostyneighbor-fresh-m…
- virustotal.com/gui/file/fa48cd1fd8aab4a43e9ff1f7985c54…
- github.com/prodaft/malware-ioc/tree/master/UNC1151
- virustotal.com/gui/file/35d1e819d2ac2535f0aa9e22945701…
- raw.githubusercontent.com/Cisco-Talos/IOCs/main/2023/07/malicious…
- otx.alienvault.com/pulse/6272996039678903e0b73dd5
- virustotal.com/gui/file/3b701eac4e3a73aec109120c97102c…
- otx.alienvault.com/pulse/622f3ca087e68a2746132fc8
- tria.ge/260513-m7anjahw5v/behavioral1
- twitter.com/kyleehmke/status/1397746852213186561
- twitter.com/sekoia_io/status/1497239319295279106
- x.com/smica83/status/2054518692298273011
- cert.gov.ua/article/37626 (Ukrainian)
- content.fireeye.com/web-assets/rpt-unc1151-ghostwriter-upda…
- otx.alienvault.com/pulse/621f7303abae83b8f3814de0
- otx.alienvault.com/pulse/6089a10aa27c23fdd4ee928e
- otx.alienvault.com/pulse/621cce4e2752128dbfe537ed
- twitter.com/JAMESWT_MHT/status/1501197380225490949
- fireeye.com/content/dam/fireeye-www/blog/pdfs/unc11…
44 more, and the report behind every indicator, in UNC1151.json.