Sentinelone

Cybercrime Networks Disrupted Amid Ongoing Exploits and Attacks

First seen 2 Dec 2025, 18:33 UTC • Sentinelone

•100% similarity •7.2

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Authorities have dismantled major cybercrime networks, including SIM-box fraudsters and ransomware operations. Recent exploits include UNC6485 targeting Triofox for remote code execution and SleepyDuck leveraging Ethereum for malware distribution. Additionally, Iranian-linked actors are reportedly targeting U.S. policy experts, highlighting ongoing geopolitical cyber threats.

ThreatCluster AI How this analysis works

Attack Flow

10 entities, 10 inferred relationships (STIX 2.1).

Threat Actor (1)

Unc6485

Technique (4)

Data Breach
Malware
Ransomware
Zero-day Exploit

Organization (3)

Washington Post
Ethereum
Oracle

Tool (1)

Triofox

Vulnerability (1)

Brash

Relationships

Unc6485 uses Triofox
Unc6485 uses Data Breach
Unc6485 uses Malware
Unc6485 uses Ransomware
Unc6485 uses Zero-day Exploit
Unc6485 exploits Brash
Triofox exploits Brash
Unc6485 targets Washington Post
Unc6485 targets Ethereum
Unc6485 targets Oracle

Community

Browse all →

Tracked Entities in This Story

Unc6485 Washington Post Ethereum Oracle

Cybercrime Networks Disrupted Amid Ongoing Exploits and Attacks

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story