UNC4221
UNC4221, also known as UAC-0185, is a Russia-aligned threat cluster focused on battlefield technology, secure communications, and attacks on Ukrainian and allied defense assets. Reporting cited in the content links UNC4221 to campaigns targeting secure messaging applications, especially Signal accounts used by Ukrainian military personnel, as well as broader messenger-account targeting activity. The actor has used social engineering to abuse Signal’s linked-devices feature, including phishing pages with malicious QR codes, fake Signal device-linking instructions, and infrastructure mimicking the Ukrainian military’s Kropyva application, with the goal of tricking victims into linking their Signal account to an attacker-controlled device and enabling message interception. Related reporting in the content also states UNC4221 and UNC5792 abused Signal and WhatsApp features with fake group invites and phishing pages to hijack accounts. The content attributes multiple Android-focused malware and delivery techniques to UNC4221. It states the group used STALECOOKIE, an Android malware that mimics Ukraine’s DELTA battlefield management platform to steal browser cookies. It also states UNC4221 used ClickFix to deliver the TINYWHALE downloader, which then dropped MeshAgent remote management software. Additional reporting cited in the content says UNC4221 used a custom phishing kit and a lightweight JavaScript payload called PINPOINT to collect basic user information and geolocation data through phishing pages. The group is described as Russia-linked or Russia-aligned in multiple cited reports, including reporting that similar campaigns were linked by Microsoft and Google Threat Intelligence Group to Star Blizzard, UNC5792/UAC-0195, and UNC4221/UAC-0185. Known alias: UAC-0185.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Software & Services
- Commercial & Professional Services
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
- 🇩🇪 Germany
- 🇳🇱 Netherlands
- 🇫🇷 France
Where they're from
Attributed origin per open-source reporting.
- RU
Tradecraft
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
5 malware families attributed to this actor across reporting.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Russia-aligned threat cluster linked to phishing campaigns aimed at compromising WhatsApp and Signal accounts of high-value targets.
Russian cluster described as focusing on battlefield technology, secure communications, and attacks on Ukrainian and allied defense assets.
Account hijacking and malware deployment via abuse of Signal/WhatsApp workflows (fake group invites, phishing pages).
Targeting messenger accounts (notably Signal) using malicious QR codes to abuse device-linking/account authorization features, enabling session hijacking and subsequent exfiltration of message history and account data; activity noted in the context of targeting Ukraine during the Russia-Ukraine war.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.