UNC5227

A financially motivated intrusion cluster active since late 2023. It uses stolen or brute-forced VPN credentials, open-source tools, PORTLIGHT, and data-exfiltration utilities, and its access has led to deployments of LockBit, ALPHV, Rhysida, and RansomHub ransomware.