UNC4221

☆ pin

Also known as UAC-0185

Reports

First seen

Jun 26, 2026

Last seen

Jul 1, 2026

Motivation

Espionage

Targeting

Sectors

Government ×5

Victim regions

×1

×2

United States×2

Ukraine×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1566 Phishing ×6T1110 Brute Force ×4T1598 Phishing for Information ×3T1005 Data from Local System ×2T1187 Forced Authentication ×2T1078 Valid Accounts ×2T1589.003 Gather Victim Identity Information: Credentials ×1T1621 Multi-Factor Authentication Request Generation ×1T1587.003 Develop Capabilities: Digital Certificates ×1T1133 External Remote Services ×1T1566.002 Phishing: Spearphishing Link ×1T1111 Multi-Factor Authentication Interception ×1

Indicators

cve ×4domain ×2

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-11645 (exploited)CVE-2026-20230 (exploited)CVE-2026-28318 (exploited)CVE-2026-42897 (exploited)

Recent reports

High

UNC4221

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

CERT-EU Cyber Brief June 2026 – Multi-Sector Espionage, Ransomware, and Zero-Days

US Offers $10M Reward for Russian Cyber Groups Targeting Signal, WhatsApp

U.S. offers $10 million bounty for information on UNC5792 and UNC4221 hacker groups targeting WhatsApp, Signal

Ukraine and FBI Expose Russian Intelligence Phishing Campaign Targeting Messaging Apps

FBI warns of Russian intelligence phishing campaign targeting Signal backup recovery keys

FBI and CISA Warn of Russian Intelligence Phishing Signal Backup Recovery Keys