UNC5280

A financially motivated cluster associated with Akira ransomware operations since late 2023. It has used valid VPN credentials, SSH, Metasploit, credential theft, data exfiltration, and anti-forensic actions before encryption and extortion.