UNC6353

Overview 26 indicators

No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.

Principal sources 6 reports

Ranked by how many of this actor's indicators each report brought in.

• 10x.com/_IMalihi_/status/2067948568401395880
• 7x.com/felixaime/status/2034580922742235351
• 7lookout.com/threat-intelligence/article/darksword
• 2x.com/MalforsHQ/status/2037293707351765450
• 2x.com/threatinsight/status/2037563799142858899
• 2virustotal.com/gui/file/b7ef4985662625c45955db295d949e…

Timeline 26 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2026-06-20 10 domainthis year

   x.com/_IMalihi_/status/2067948568401395880

   cartned.sheexcell.ink

   duflaro.com

   inventorepkrje.sheexcell.ink

   iokert.com

   lifechangerai.site

   link.sheexcell.ink

   mxloft.sheexcell.ink

   sheexcell.ink

   t.sheexcell.ink

   wwteam.space

   copy batch

2. 2026-03-27 2 domainthis year

   x.com/MalforsHQ/status/2037293707351765450 · x.com/threatinsight/status/2037563799142858899 · virustotal.com/gui/file/b7ef4985662625c45955db295d949e…

   escofiringbijou.com

   siekeltd.com

   copy batch

3. 2026-03-19 7 domainthis year

   x.com/felixaime/status/2034580922742235351

   afewminago.site

   downdown.online

   nuceciwa138.xyz

   rhdcnwjnwf.site

   shkaacloud.ink

   touch-n-go.online

   world-news.site

   copy batch

4. 2026-03-18 7 domainthis year

   lookout.com/threat-intelligence/article/darksword

   cdn.cdncounter.net

   cdn.uacounter.com

   cdncounter.net

   count.cdncounter.net

   sqwas.shapelie.com

   static.cdncounter.net

   uacounter.com

   copy batch

Further reading 6

• x.com/threatinsight/status/2037563799142858899
• x.com/felixaime/status/2034580922742235351
• x.com/_IMalihi_/status/2067948568401395880
• virustotal.com/gui/file/b7ef4985662625c45955db295d949e…
• lookout.com/threat-intelligence/article/darksword
• x.com/MalforsHQ/status/2037293707351765450