UnclassifiedIdeologyExpert sophistication
UNC6353
UNC6353 is a Russia-attributed threat actor group with an ideological motive, tracked by Brandefense. It targets 5 sectors, including Government, and Defense and Aerospace, in Ukraine. It uses 24 MITRE ATT&CK techniques.
- Origin
- Russia
- Techniques
- 24
- Exploited CVEs
- No CVE data
- Record updated
Who They Target.
Countries · 1
How They Operate · MITRE ATT&CK.
24 techniques across 11 of 14 tacticsReconnaissance1
T1071.001
Application Layer Protocol: Web Protocols
Application Layer Protocol: Web Protocols
Resource Development·
Initial Access6
T1189
Drive-by Compromise
Drive-by Compromise
T1190
Exploit Public-Facing Application
Exploit Public-Facing Application
T1203
Exploitation for Client Execution
Exploitation for Client Execution
T1210
Exploitation of Remote Services
Exploitation of Remote Services
T1476
Deliver Malicious Application via Other Means
Deliver Malicious Application via Other Means
T1566.002
Phishing: Spearphishing Link
Phishing: Spearphishing Link
Execution6
T1053.005
Scheduled Task/Job: Scheduled Task
Scheduled Task/Job: Scheduled Task
T1059.001
Command and Scripting Interpreter: PowerShell
Command and Scripting Interpreter: PowerShell
T1059.006
Command and Scripting Interpreter: Python
Command and Scripting Interpreter: Python
T1059.007
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: JavaScript
T1119
Automated Collection
Automated Collection
T1407
Download New Code at Runtime
Download New Code at Runtime
Persistence1
T1546.007
Event Triggered Execution: Netsh Helper DLL
Event Triggered Execution: Netsh Helper DLL
Privilege Escalation3
T1068
Exploitation for Privilege Escalation
Exploitation for Privilege Escalation
T1404
Exploitation for Privilege Escalation
Exploitation for Privilege Escalation
T1548.002
Abuse Elevation Control Mechanism: Bypass User Account Control
Abuse Elevation Control Mechanism: Bypass User Account Control
Defense Evasion1
T1636
Adversary Use of Accessibility Services
Adversary Use of Accessibility Services
Credential Access1
T1003.003
OS Credential Dumping: NTDS
OS Credential Dumping: NTDS
Discovery1
T1083
File and Directory Discovery
File and Directory Discovery
Lateral Movement·
Command and Control1
T1568.001
Dynamic Resolution: Fast Flux DNS
Dynamic Resolution: Fast Flux DNS
Exfiltration1
T1041
Exfiltration Over C2 Channel
Exfiltration Over C2 Channel
Impact·
Vulnerabilities Linked To Their Tools.
Browse Vulnerability Intelligence →CVE-2025-24201Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web…ExploitedcriticalCVE-2025-31200Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously…ExploitedcriticalCVE-2026-31001No public summary yet.
Arsenal · Malware And Tools.
- Btmobmalware
- CamelSpymalware
- Corunamalware
- DarkSwordmalware
- PlasmaLoadermalware
Campaigns.
- Russian Mobile Espionage Operations in Ukraine
About UNC6353.
A Russian-aligned threat actor tracked targeting Apple iOS mobile devices across Ukrainian sectors using the DarkSword exploit kit.
Last updated Sep 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.