# UNC3973: threat group profile

> UNC3973 is a threat group. Public reporting about it is still limited. This free profile brings together what is known about it, so you can judge the risk to you. It lists the other names the group goes by and links to every public report behind it.

Canonical page: https://www.edgeprotect.io/threat-actors/unc3973
Breadcrumb: [Home](https://www.edgeprotect.io/) > [Threat groups](https://www.edgeprotect.io/threat-actors) > UNC3973

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 0 |
| Thought to operate from | Not known |
| Other names | 0 |
| Public reports | 2 |

## Who is UNC3973?

UNC3973 is a threat group. Public reporting about it is still limited.

### What public reporting says

> UNC3973 is a financially motivated threat actor tracked by Mandiant, distinguished from the broader BASTA ransomware ecosystem (primarily tracked as UNC4393) due to its unique operational characteristics and TTPs. This actor has demonstrated a specific focus on supply chain compromises, as evidenced by their June campaign targeting credit unions in western Canada via a compromised managed service provider (MSP). UNC3973 leverages unauthorized service accounts with elevated privileges, specifically domain administrator accounts shared between the compromised MSP and the target organizations, to gain initial access.This actor's post-exploitation activity includes attempts to disable security controls and deploy the SYSTEMBC tunneler for command and control (C2) communication, followed by attempts to deploy BASTA ransomware. While their attempts to deploy both SYSTEMBC and BASTA have been observed, these were thankfully thwarted by endpoint security solutions in observed instances. The targeted, supply chain-enabled nature of UNC3973's intrusions, coupled with its use of privileged shared accounts and attempts at deploying BASTA, all suggest that it is an exclusive group, perhaps even affiliates working closely with or possibly operating under the direct control, BASTA ransomware operators. This group's ability to exploit centralized access points, like MSPs, represents a significant threat to organizations reliant on third-party providers.

## Public reports about UNC3973

- https://services.google.com/fh/files/misc/m_trends_2023_report.pdf
- https://cloud.google.com/blog/topics/threat-intelligence/unc4393-goes-gently-into-silentnight

## Frequently asked questions

### Who is UNC3973?

UNC3973 is a threat group. Public reporting about it is still limited.

### How do I know if UNC3973 is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free EdgeProtect account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.edgeprotect.io/register
- Book a demo: https://www.edgeprotect.io/contact