← All actors Recent activity

UNC961

UNC961

Indicators
17
Source reports
7
Activity span
not dated
Newest indicator
unknown
Upstream change
2026-01-02

Overview 17 indicators

No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.

ipv49UNC961.json
url8UNC961.json

Principal sources 7 reports

Ranked by how many of this actor's indicators each report brought in.

What the sources have in common — not a claim that these are the same actor. See the whole graph.

Timeline 17 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

  1. 8 ipv4, 8 url4 yrs ago

    mandiant.com/resources/mobileiron-log4shell-exploita… · mandiant.com/resources/blog/unc961-multiverse-financ… · crowdstrike.com/blog/prophet-spider-exploits-citrix-sha… · otx.alienvault.com/pulse/6244606893ddbc9a6a5bbdeb · otx.alienvault.com/pulse/641c9c1ed12f8bb9ab022552 · virustotal.com/gui/file/1c26b4078c75e10420f5a556e25654… · virustotal.com/gui/file/ec8fcc5f5bc33d9cbe3b1d14a2c39b…

    ipv4107.181.187.184:443
    ipv4149.28.200.140:443
    ipv4149.28.71.70:443
    ipv4162.33.178.149:443
    ipv4185.172.129.215:443
    ipv4195.149.87.87:443
    ipv434.102.54.152:443
    ipv445.61.136.188:443
    urlhttp://107.181.187.184
    urlhttp://149.28.200.140
    urlhttp://149.28.71.70
    urlhttp://162.33.178.149
    urlhttp://185.172.129.215
    urlhttp://195.149.87.87
    urlhttp://34.102.54.152
    urlhttp://45.61.136.188

  2. 1 ipv44 yrs ago

    mandiant.com/resources/mobileiron-log4shell-exploita… · mandiant.com/resources/blog/unc961-multiverse-financ… · crowdstrike.com/blog/prophet-spider-exploits-citrix-sha… · otx.alienvault.com/pulse/6244606893ddbc9a6a5bbdeb · otx.alienvault.com/pulse/641c9c1ed12f8bb9ab022552 · virustotal.com/gui/file/1c26b4078c75e10420f5a556e25654… · virustotal.com/gui/file/ec8fcc5f5bc33d9cbe3b1d14a2c39b…

    107.181.187.184:4242

Further reading 7