Add BlackBasta affiliates

clusters/threat-actor.json

@@ -16589,7 +16589,23 @@
       "description": "UNC4393 is a financially motivated threat actor primarily using BASTA ransomware. They have been active since early 2022 and have targeted over 40 organizations across various industries. UNC4393 has shown a willingness to cooperate with other threat clusters for initial access and has evolved from using existing tools to developing custom malware. They focus on efficient data exfiltration and multi-faceted extortion, often utilizing tools like COGSCAN and RCLONE for reconnaissance and data theft.",
       "meta": {
         "refs": [
-          "https://cloud.google.com/blog/topics/threat-intelligence/unc4393-goes-gently-into-silentnight"
+          "https://cloud.google.com/blog/topics/threat-intelligence/unc4393-goes-gently-into-silentnight",
+          "https://www.security.com/threat-intelligence/black-basta-ransomware-zero-day",
+          "https://cloud.google.com/blog/topics/threat-intelligence/detecting-disrupting-malvertising-backdoors/",
+          "https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/",
+          "https://news.sophos.com/en-us/2025/01/21/sophos-mdr-tracks-two-ransomware-campaigns-using-email-bombing-microsoft-teams-vishing/",
+          "https://www.esentire.com/security-advisories/ongoing-email-bombing-campaigns-leading-to-remote-access-and-post-exploitation",
+          "https://redcanary.com/blog/threat-intelligence/storm-1811-black-basta/",
+          "https://x.com/MsftSecIntel/status/1881751635598139714",
+          "https://techcommunity.microsoft.com/blog/microsoftsecurityexperts/phish-click-breach-hunting-for-a-sophisticated-cyber-attack/4267916",
+          "https://services.google.com/fh/files/misc/m_trends_2023_report.pdf",
+          "https://cloud.google.com/blog/topics/threat-intelligence/unc4393-goes-gently-into-silentnight",
+          "https://services.google.com/fh/files/misc/m-trends-2024.pdf"
+        ],
+        "synonyms": [
+          "Storm-1811",
+          "STAC5777",
+          "Cardinal"
         ]
       },
       "uuid": "8191e28a-fb2d-4d50-b992-b877807a2f37",
@@ -17726,6 +17742,17 @@
       },
       "uuid": "12c9522e-41d7-442b-ae0e-134249732fbb",
       "value": "ExCobalt"
+    },
+    {
+      "description": "UNC3973 is a financially motivated threat actor tracked by Mandiant, distinguished from the broader BASTA ransomware ecosystem (primarily tracked as UNC4393) due to its unique operational characteristics and TTPs. This actor has demonstrated a specific focus on supply chain compromises, as evidenced by their June campaign targeting credit unions in western Canada via a compromised managed service provider (MSP). UNC3973 leverages unauthorized service accounts with elevated privileges, specifically domain administrator accounts shared between the compromised MSP and the target organizations, to gain initial access.This actor's post-exploitation activity includes attempts to disable security controls and deploy the SYSTEMBC tunneler for command and control (C2) communication, followed by attempts to deploy BASTA ransomware. While their attempts to deploy both SYSTEMBC and BASTA have been observed, these were thankfully thwarted by endpoint security solutions in observed instances. The targeted, supply chain-enabled nature of UNC3973's intrusions, coupled with its use of privileged shared accounts and attempts at deploying BASTA, all suggest that it is an exclusive group, perhaps even affiliates working closely with or possibly operating under the direct control, BASTA ransomware operators. This group's ability to exploit centralized access points, like MSPs, represents a significant threat to organizations reliant on third-party providers.",
+      "meta": {
+        "refs": [
+          "https://services.google.com/fh/files/misc/m_trends_2023_report.pdf",
+          "https://cloud.google.com/blog/topics/threat-intelligence/unc4393-goes-gently-into-silentnight"
+        ]
+      }, 
+      "uuid":"",
+      "value": "UNC3973"
     }
   ],
   "version": 322