UNG0901
Also reported as Operation CargoTalon and Unknown-Group-901.
Reports per quarter
Techniques seen in the last two years
- T1036 2 reports
- T1041 2 reports
- T1059.001 2 reports
- T1566.001 2 reports
- T1005 1 report
- T1027.002 1 report
- T1027.010 1 report
- T1055.002 1 report
- T1059.003 1 report
- T1071 1 report
Show all 31 techniques Show fewer
- T1071.001 1 report
- T1082 1 report
- T1204.001 1 report
- T1204.002 1 report
- T1218.011 1 report
- T1482 1 report
- T1485 1 report
- T1489 1 report
- T1491 1 report
- T1537 1 report
- T1546.015 1 report
- T1566.002 1 report
- T1574.001 1 report
- T1583.001 1 report
- T1583.003 1 report
- T1583.004 1 report
- T1584.001 1 report
- T1591 1 report
- T1591.002 1 report
- T1608.001 1 report
- T1657 1 report
Counts come from technique IDs in the actor's report text.
CVEs named in reports
- CVE-2018-0171 KEV
- CVE-2025-29824 KEV ransomware
- CVE-2025-32433 KEV
- CVE-2025-49704 KEV ransomware
- CVE-2025-49706 KEV ransomware
- CVE-2025-53770 KEV ransomware
- CVE-2025-53771
- CVE-2025-6218 KEV
- CVE-2025-8088 KEV ransomware
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
Newest first. Details opens the report in Explore.