UNC2565

A financially motivated cluster that distributes GOOTLOADER through search-engine optimization poisoning and compromised websites. Successful infections can lead to Cobalt Strike, credential theft, data exfiltration, and ransomware deployment by downstream operators.