UNC5114
UNC5114 is a suspected Russia-linked espionage cluster assessed in reporting on Russia-nexus operations targeting Ukraine and allied defense interests. It is described as one of multiple Russian clusters focusing on battlefield technology, secure communications, and direct attacks on Ukrainian and allied defense assets. UNC5114 has been reported delivering a variant of the off-the-shelf Android malware CraxsRAT by masquerading it as an update for Kropyva, a combat control/battlefield management system used in Ukraine (i.e., fake app update delivery). This activity aligns UNC5114 with Android-focused targeting of Ukrainian military/battlefield tooling and associated users/devices. Known alias(es) mentioned: UNC5114.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they target
Geographies tied to known operations.
- 🇺🇦 Ukraine
Where they're from
Attributed origin per open-source reporting.
- RU
Tradecraft
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Russian cluster described as focusing on battlefield technology, secure communications, and attacks on Ukrainian and allied defense assets.
Android-focused distribution of a RAT by masquerading as an update to a Ukrainian military-related application (Kropyva).
Suspected Russian espionage targeting Ukrainian users via trojanized Android app updates (Kropyva-themed) to deploy commodity Android RAT capability.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.