Unc3810

UNC3810 is a malware identified and tracked by cybersecurity firm Mandiant, notorious for its deployment of CaddyWiper in October 2022. This malicious software is designed to exploit and damage computer systems, often infiltrating via suspicious downloads, emails, or websites. The threat actor, initially tracked as UNC3810 before being merged with Sandworm, has been associated with Russia's Main Intelligence Directorate (GRU) since 2009, primarily targeting Ukraine. It employs OT-level living off the land (LotL) techniques, which involve using legitimate tools already present on the target system to carry out malicious activities. A significant incident involving UNC3810 occurred when the 'CyberArmyofRussia_Reborn' persona boasted about a wiper attack on Telegram, claiming responsibility for the disruptive operation. The attack was allegedly perpetrated by a GRU operator codenamed UNC3810, utilizing the CaddyWiper malware. However, due to a series of operator errors, UNC3810 was unable to complete the wiper attack before the boastful Telegram post, indicating premature celebration. Mandiant's investigation revealed that the 'CyberArmyofRussia_Reborn' significantly exaggerated the success of the wiper attack. Technical artifacts from UNC3810’s intrusion indicate that the attack was not as successful as claimed. The Telegram post, in fact, preceded CaddyWiper's execution by 35 minutes, thereby undermining CyberArmyofRussia_Reborn's repeated claims of independence from the GRU. These findings highlight the complex relationship between UNC3810, the GRU, and the 'CyberArmyofRussia_Reborn', revealing a web of misinformation and cyber warfare.