← All actors Recent activity

UNC4221

UNC4221

Indicators
96
Source reports
4
Activity span
not dated
Newest indicator
unknown
Upstream change
2026-01-02
20242026

Overview 96 indicators

No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.

domain95UNC4221-domain.txt
ipv41UNC4221.json

Principal sources 4 reports

Ranked by how many of this actor's indicators each report brought in.

What the sources have in common — not a claim that these are the same actor. See the whole graph.

Timeline 96 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

  1. or earlier 6 domainthis year

    x.com/TLP_R3D/status/1892221224094445666 · cloud.google.com/blog/topics/threat-intelligence/russia-…

    add-group.site
    helperanalytics.ru
    join-group.online
    signal-protect.host
    teneta.add-group.site
    teneta.join-group.online

  2. 88 domain, 1 ipv42 yrs ago

    cert.gov.ua/article/6281632 (# UAC-0185) · virustotal.com/gui/file/9f29d27cdad37a6451f3ccd2f3c054…

    domain212nj0b42w.web.telegram-account.host
    domain658pvbhj2k7veemmv4.web.telegram-account.host
    domainaccept-action.site
    domainaccount-guard.site
    domainaccount-saver.com
    domainaccount-viewer.com
    domaincancel-action.site
    domaincancel-auth.site
    domaincheck-active.site
    domaincheck.sign-cert.com
    domaincloud.account-viewer.com
    domaincloud.god-le.net
    domainclouddrive.world
    domainconfirm-signal.site
    domainconfirm.account-viewer.com
    domainconfirmphone.site
    domaindefender-bot.site
    domaindelta.milgov.site
    domainderzhposluhy.com
    domaindevice.redirecl.com
    domaindhl.redirecl.com
    domaindrive-share.site
    domaindrive.redirecl.com
    domainemtserviceca.info
    domainget.god-le.com
    domainget.in-touc.com
    domainget.mail-gov.com
    domainget.sign-cert.com
    domaingod-le.com
    domaingod-le.net
    domaingoogle.drive-share.site
    domaingoogle.share-drive.site
    domaingroup-invitation.site
    domaingroup-teneta.online
    domaingroup.kropyva.site
    domaingroup.teneta.site
    domainhomeskart.shop
    domainhomeway.xyz
    domaini-ua.account-guard.site
    domainin-touc.com
    domainivanti.account-viewer.com
    domainkropyva.group
    domainkropyva.site
    domainlive.outloolc.com
    domainmail-gov.com
    domainmail-gov.net
    domainmail.outloolc.com
    domainmails.support
    domainmilgov.host
    domainmilgov.site
    domainmirotrent.com
    domainmy.mail-gov.net
    domainodwebp.com
    domainoutloolc.com
    domainpalantir.ink
    domainpassport-ukr-net.site
    domainplntr.account-viewer.com
    domainplntr.mirotrent.com
    domainprotect-password.site
    domainqsrgh.site
    domainqweasdzx.site
    domainredirecl.com
    domainshare-drive.site
    domainsign-cert.com
    domainspam.web-telegram.host
    domainstellar.account-viewer.com
    domainsvc.odwebp.com
    domainteiegram.host
    domaintelegram-account.host
    domaintelegram-auth.website
    domaintelegram-confirm.site
    domaintelegram.check-active.site
    domaintelegram.defender-bot.site
    domaintelegram.qweasdzx.site
    domaintelegram.token-defender.cloud
    domaintelegramm-account.site
    domainteneta.group
    domainteneta.site
    domaintoken-defender.cloud
    domainuspp.derzhposluhy.com
    domainweb-telegram.host
    domainweb.teiegram.host
    domainweb.telegram-account.host
    domainweb.telegramm-account.site
    domainweb.web.telegram-account.host
    domainwhatsapp-confirm.site
    domainwhatsapp.group-invitation.site
    domainwhatsapp.protect-password.site
    ipv4185.225.35.75:30555

  3. 1 domain2 yrs ago

    cert.gov.ua/article/6281632 (# UAC-0185) · virustotal.com/gui/file/9f29d27cdad37a6451f3ccd2f3c054… · x.com/TLP_R3D/status/1892221224094445666 · cloud.google.com/blog/topics/threat-intelligence/russia-…

    signal-confirm.site

Further reading 4