UNC5277

A financially motivated cluster associated with Akira ransomware, tracked by some vendors as REDBIKE. It uses stolen VPN credentials and vulnerability exploitation, including Veeam CVE-2023-27532, then steals data and deploys ransomware.