← All Threat Actors
Threat Actor Profile

UNC6748

No known aliases in database
▲ High Threat
Saudi Arabian Snapchat Decoy Campaign
Origin Russia
Motivation monetary gain (cryptocurrency theft) and espionage

Target Sectors

Saudi Arabia iOS users Cryptocurrency exchange and wallet users

Known TTPs

DarkSword iOS full-chain exploit kit
GHOSTKNIFE backdoor deployment
Snapchat-themed social engineering lures
JavaScript obfuscation
IFrame injection via snapshare[.]chat
Anti-debugging and session storage checks
Exploitation of x-safari-https protocol handler to force Safari usage
Use of zero-day vulnerabilities (CVE-2025-31277, CVE-2026-20700)

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…

LINK COPIED TO CLIPBOARD