UNC2165

A financially motivated cluster with strong overlap with the sanctioned Evil Corp cybercrime group. Since 2019 it has used FakeUpdates and varied ransomware brands, including Hades and LockBit-related deployments, apparently changing tooling and partners to complicate attribution and sanctions enforcement.