🇷🇺

UNC1878

APT Group Financial gain Financial crime ETDA ✓

Also Known As

No alias recorded

Target Countries

No target country recorded

Sectors Targeted

No targeted sector recorded

Details

Origin 🇷🇺 RU

Last Updated 13 Apr 2026

Malware Families 8

anchor_dns

BAZARBACKDOOR

feodo

EMOTET

zhmimikatz

bazarnimrod

TRICKBOT

anchormail

MITRE ATT&CK 96

T1003 T1003.001 T1003.002 T1003.003 T1005 T1016 T1018 T1021 T1021.001 T1021.002 T1021.006 T1027 T1027.002 T1027.010 T1033 T1036 T1036.004 T1041 T1047 T1048 T1048.003 T1053 T1053.005 T1055 T1055.001 T1059 T1059.001 T1059.003 T1070 T1070.004 T1071 T1071.001 T1074 T1074.001 T1078 T1078.001 T1078.002 T1082 T1087 T1087.002 T1105 T1112 T1133 T1135 T1136 T1136.001 T1136.002 T1197 T1204 T1204.001 T1204.002 T1210 T1218 T1218.011 T1222 T1222.001 T1486 T1489 T1490 T1518 T1518.001 T1518.002 T1543 T1543.003 T1547 T1547.001 T1547.004 T1550 T1550.002 T1552 T1552.006 T1553 T1553.002 T1555 T1555.004 T1557 T1557.001 T1558 T1558.003 T1560 T1560.001 T1562 T1562.001 T1566 T1566.001 T1566.002 T1567 T1567.002 T1569 T1569.002 T1570 T1585 T1585.002 T1588 T1588.002 T1588.003

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 1 entries

UNC1878 FireEye

Observed Target Countries 1

Based on ETDA data — countries highlighted in red

USA

Description

(BleepingComputer) Wyckoff Heights Medical Center in Brooklyn and the University of Vermont Health Network are the latest victims of the Ryuk ransomware attack spree covering the healthcare industry across the U.S. Yesterday, the U.S. government hosted an emergency call with stakeholders in the healthcare industry to alert them to an 'increased and imminent cybercrime threat to U.S. hospitals and healthcare providers.' Later in the day, CISA issued a joint advisory publicly warning that U.S. hospitals and healthcare providers are actively targeted in cyberattacks deploying the Ryuk ransomware. Charles Carmakal, senior vice president and CTO of Mandiant, told BleepingComputer that an Eastern European hacking group known as UNC1878 is responsible for these attacks and that they intend to attack hundreds of hospitals.

Tools Used 3

BazarBackdoor Cobalt Strike Ryuk

Reports & References 2

https://www.bleepingcomputer.com/news/security/brooklyn-and-vermont-hospitals-are-latest-ryuk-ransomware-victims/ https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/

ETDA Profile

UNC1878

Origin

[Unknown]

First Seen 2020

Motivation

Financial gain

View on ETDA APT Groups ↗