Search threats, CVEs… ⌘K
← Back to all threat actors

unknown

"Unknown" is a catch-all tracking label used on ransomware monitoring platforms for attacks where the responsible threat actor has not been positively attributed to a known named group, serving as a placeholder for unattributed incidents.

How we source and review actor profiles
Motivation
ransomware
Status
Dormant

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

Cataloged
Indicator2 indicators cataloged

Types: onion.

First observed
CVECVE-2025-20333 linked to this actor

FIRESTARTER Backdoor

First observed
CVECVE-2025-20362 linked to this actor

FIRESTARTER Backdoor

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

unknownCanonical Name

Loading CVEs, techniques, indicators, malware, victims, and activity...