UNC4393: Collaboration Leads to BASTA Ransomware Attacks

UNC4393, the core operator behind the BASTA ransomware, conducts financially motivated ransomware and extortion campaigns across multiple industries (over 40 intrusions), has a growing presence in healthcare, and uses a complex, evolving toolset (BASTA, SYSTEMBC, DAWNCRY, PORTYARD, KNOTROCK, COGSCAN, SILENTNIGHT) and varied access methods (QAKBOT historically, now malvertising) to perform reconnaissance, lateral movement, exfiltration, and automated encryption.