Overview 27 indicators
No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.
| domain | 21 | UNC2190-domain.txt |
| ipv4 | 5 | UNC2190.json |
| url | 1 | UNC2190.json |
Principal sources 4 reports
Ranked by how many of this actor's indicators each report brought in.
- 23mandiant.com/resources/sabbath-ransomware-affiliate
- 23virustotal.com/gui/file/79b47780382f54ca039ad248d8241e…
- 2twitter.com/th3_protoCOL/status/1490847701012869120
- 2github.com/thetanz/ransomwatch/blob/main/docs/INDE…
Related groups 1
What the sources have in common — not a claim that these are the same actor. See the whole graph.
Timeline 27 indicators
Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.
No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.
-
twitter.com/th3_protoCOL/status/1490847701012869120
securingyourpc.com security4themasses.com -
github.com/thetanz/ransomwatch/blob/main/docs/INDE…
54bb47h.blog 54bb47h5qu4k7l4d7v5ix3i6ak6elysn3net4by4ihmvrhu7cvbskoqd.onion -
mandiant.com/resources/sabbath-ransomware-affiliate · virustotal.com/gui/file/79b47780382f54ca039ad248d8241e…
domain 4bb47h5qu4k7l4d7v5ix3i6ak6elysn3net4by4ihmvrhu7cvbskoqd.onion domain cofeeloveers.com domain datatransferdc.com domain doratir.com domain farhadl.com domain frankir.com domain gordonzon.com domain greentuks.com domain helpgoldr.com domain markettc.biz domain probes.site domain probes.space domain probes.website domain tinysidney.com ipv4 45.141.84.182:443 ipv4 45.146.166.24:443 ipv4 45.147.230.137:3001 ipv4 45.147.230.221:2002 ipv4 45.79.55.129:443 url http://45.79.55.129 -
mandiant.com/resources/sabbath-ransomware-affiliate · virustotal.com/gui/file/79b47780382f54ca039ad248d8241e…
aequuira1aedeezais5i.probes.space aimee0febai5phoht2ti.probes.website jeithe7eijeefohch3qu.probes.site