Unc2165

UNC2165, a threat actor group with financial motivations, has been identified as the force behind multiple LockBit ransomware intrusions. This group shares several characteristics with another publically known group, Evil Corp. Research conducted by Mandiant reveals that UNC2165 has been shifting its operations to evade sanctions and ensure continuity of its malicious activities. The group's activities have raised significant concerns in the cybersecurity community due to their persistent and adaptive nature. This group has shown an alarming adaptability by frequently changing the brand of ransomware they deploy. According to statements made by Goody, this change in strategy is believed to be a response to difficulties the group encountered when attempting to receive payments from victim organizations. By continuously altering their ransomware brand, UNC2165 has managed to maintain its operations despite increasing scrutiny and attempts to thwart their activities. The connection between UNC2165 and Evil Corp became more evident when one cyber-crime crew tracked by Mandiant, which has ties to Evil Corp, started switching up the ransomware it deployed after the US sanctioned Evil Corp in 2019 over its development and use of Dridex malware. Further evidence linking UNC2165 to Evil Corp came when Ryzhenkov was associated with the alias mx1r and connected to UNC2165, suggesting an evolution of Evil Corp affiliated actors.