UNC4393 Goes Gently into the SILENTNIGHT

Mandiant tracks UNC4393 as a financially motivated threat cluster responsible for deploying BASTA ransomware since 2022; the report outlines the group's private affiliate model, rapid operational tempo (median time to ransom ~42 hours), reliance on initial access brokers (historically QAKBOT, later DARKGATE and SILENTNIGHT), multiple supporting malware families (e.g., SYSTEMBC, KNOTWRAP, DAWNCRY, KNOTROCK), and notable TTPs including DNS beaconing and living-off-the-land techniques.