DriveSurge (UNC-4822)
Tactical TTP Profile: Specializes in large-scale CMS compromise, social engineering overlays (ClickFix), and PowerShell-based malware delivery. Known for using AI to localize lures.
DriveSurge represents the next generation of 'access brokers' who focus on volume and psychological manipulation. Their ability to maintain a fleet of 15,000+ compromised sites suggests a highly automated backend infrastructure. They are currently the primary distributors of the 'Miasma' credential stealer, indicating a possible partnership or shared infrastructure with the Shai-Hulud developers.
Tracked Campaign Appearances (1)
Tuesday, June 02, 2026
The Miasma Infiltration & The NVD Structural Crisis