UNC5155

A lightly documented initial-access cluster observed establishing access with the SILENTNIGHT backdoor that was later used by UNC4393/Black Basta. Public evidence is insufficient to determine whether it is a separate broker, affiliate, or closely related operator.