UNC5142

A financially motivated cluster active since late 2023 that compromises WordPress sites and uses blockchain-based EtherHiding infrastructure to distribute information stealers. Its CLEARFAKE and CLEARSHORT campaigns frequently use fake browser updates or ClickFix-style social engineering.