UNC3810
UNC3810 is a GRU-linked threat actor associated with disruptive operations in Ukraine. In the referenced activity, UNC3810 modified Group Policy Objects (GPOs) across a Windows domain to launch scheduled tasks that executed the CADDYWIPER wiper for disruptive effect. The actor used TANKTRAP to create Group Policy Preference files, including Files.xml to retrieve CADDYWIPER from the domain controller and Scheduledtasks.xml to create the scheduled task for execution. CADDYWIPER is described as the GRU’s most frequently observed disruptive tool in Ukraine and overwrites file contents and partitions on physical drives with null bytes. In the October 2022 incident described, UNC3810 first staged an x64 CADDYWIPER sample that was blocked by local antivirus, then recompiled and dropped an x32 variant and attempted to exclude it from antivirus scanning. The operation had extremely limited impact due to incompatible GPO settings, OS/version mismatches, lack of preparation and reconnaissance, and effective defender actions. The reporting also describes coordination between UNC3810 and the Telegram persona “CyberArmyofRussia_Reborn,” which claimed responsibility and advertised victim data while exaggerating the success of the wiper attack. Known alias in the provided content: unc3810.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they target
Geographies tied to known operations.
- 🇺🇦 Ukraine
Tradecraft
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.