UNC2198

UNC2198 is a financially motivated intrusion cluster tracked by Mandiant that used ICEDID infections as an initial foothold to monetize intrusions through ransomware deployment. Mandiant described it as the most prominent ICEDID-enabled threat cluster in the reporting and attributed nine separate intrusions in 2020 to the group. UNC2198 targeted organizations in North America across a breadth of industries. In at least five cases, it acquired initial access from UNC2420’s phishing distribution chain involving MOUSEISLAND, PHOTOLOADER, and ICEDID. Mandiant observed UNC2198 deploy MAZE ransomware in July 2020 and later shift to EGREGOR in October and November 2020, with the UNC2198-UNC2414 merge assessed as significant because it revealed UNC2198 had access to EGREGOR ransomware. Mandiant merged related clusters UNC2374 and UNC2414 into UNC2198 based on shared infrastructure and artifacts, including shared Cobalt Strike certificate subject details on TCP port 25055, shared WINDARC and BEACON file paths, shared code-signing certificate usage, shared ICEDID-based initial access, and shared RCLONE usage from C:\PerfLogs\rclone.exe. Observed tradecraft included InnoSetup droppers to install the WINDARC backdoor; BITS jobs and remote PowerShell downloads to retrieve tools such as SYSTEMBC; use of Cobalt Strike BEACON, Metasploit METERPRETER, KOADIC, and PowerShell EMPIRE; discovery activity including BloodHound and commands such as whoami, net group, nltest, and arp; lateral movement via WinRM and RDP; remote execution of BEACON service binaries; and SMB BEACON launched via PowerShell in at least one case. In one intrusion, UNC2198 used the SOURBITS utility to exploit CVE-2020-0787 for privilege escalation. Prior to ransomware deployment, UNC2198 exfiltrated hundreds of gigabytes of victim data using RCLONE, consistently observed at C:\PerfLogs\rclone.exe. Mandiant measured time-to-ransom from ICEDID activity to ransomware deployment at 5.5 days for MAZE, deployed via PsExec, and 1.5 days for EGREGOR, deployed via forced GPO updates. Known aliases and merged sub-groups directly mentioned in the content are UNC2374 and UNC2414.