UNC4393

Mandiant's name for the primary operator of Black Basta, also associated with labels such as Cardinal and Storm-1811. The group conducted ransomware and data-theft intrusions from 2022 using access brokers, social engineering, edge-device compromise, and custom tooling including SILENTNIGHT.