# UNC6353

> As of 2026-08-17, UNC6353 is a Russia-nexus threat actor tracked by Threadlinqs Intelligence across 3 threats spanning zero day, vulnerability. Also known as CryptoWaters. ATT&CK coverage spans 54 techniques across 13 tactics in 3 of 3 tracked threats. Most-observed techniques: T1005 (Data from Local System), T1027 (Obfuscated Files or Information), T1041 (Exfiltration Over C2 Channel).

- **Nation:** Russia
- **Tracked threats:** 3
- **Categories:** ZERO_DAY, VULNERABILITY
- **Also known as:** CryptoWaters
- **As of:** 2026-08-17

## ATT&CK techniques observed

54 techniques observed across 3 of 3 tracked threats. Tactics: Command and Control (9), Resource Development (9), Stealth (formerly Defense Evasion) (8), Collection (6), Credential Access (5), Execution (5).

- [T1005](https://attack.mitre.org/techniques/T1005/) Data from Local System — Collection — observed in 3 of 3 tracked threats
- [T1027](https://attack.mitre.org/techniques/T1027/) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 3 of 3 tracked threats
- [T1041](https://attack.mitre.org/techniques/T1041/) Exfiltration Over C2 Channel — Exfiltration — observed in 3 of 3 tracked threats
- [T1056](https://attack.mitre.org/techniques/T1056/) Input Capture — Collection — observed in 3 of 3 tracked threats
- [T1068](https://attack.mitre.org/techniques/T1068/) Exploitation for Privilege Escalation — Privilege Escalation — observed in 3 of 3 tracked threats
- [T1082](https://attack.mitre.org/techniques/T1082/) System Information Discovery — Discovery — observed in 3 of 3 tracked threats
- [T1113](https://attack.mitre.org/techniques/T1113/) Screen Capture — Collection — observed in 3 of 3 tracked threats
- [T1189](https://attack.mitre.org/techniques/T1189/) Drive-by Compromise — Initial Access — observed in 3 of 3 tracked threats
- [T1203](https://attack.mitre.org/techniques/T1203/) Exploitation for Client Execution — Execution — observed in 3 of 3 tracked threats
- [T1518](https://attack.mitre.org/techniques/T1518/) Software Discovery — Discovery — observed in 3 of 3 tracked threats
- [T1555](https://attack.mitre.org/techniques/T1555/) Credentials from Password Stores — Credential Access — observed in 3 of 3 tracked threats
- [T1036](https://attack.mitre.org/techniques/T1036/) Masquerading — Stealth (formerly Defense Evasion) — observed in 2 of 3 tracked threats
- [T1055](https://attack.mitre.org/techniques/T1055/) Process Injection — Privilege Escalation — observed in 2 of 3 tracked threats
- [T1059.007](https://attack.mitre.org/techniques/T1059/007/) JavaScript — Execution — observed in 2 of 3 tracked threats
- [T1070](https://attack.mitre.org/techniques/T1070/) Indicator Removal — Stealth (formerly Defense Evasion) — observed in 2 of 3 tracked threats

## Tracked threats

- [DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors (CVE-2026-20700, CVE-2025-43529, CVE-2025-31277)](https://intel.threadlinqs.com/threat/TL-2026-0245) — CRITICAL
- [Coruna iOS Exploit Kit — 23 Exploits Across 5 Chains Targeting iOS 13-17.2.1 (CVE-2021-30952, CVE-2023-41974, CVE-2023-43000 + 20 More)](https://intel.threadlinqs.com/threat/TL-2026-0186) — CRITICAL
- [Coruna iOS Exploit Kit — Government-Grade 23-Exploit Arsenal Proliferates from Surveillance Vendor to Russian Espionage and Chinese Cybercriminals Targeting 42K+ Devices](https://intel.threadlinqs.com/threat/TL-2026-0174) — CRITICAL

## Related CVEs

31 CVEs referenced by tracked UNC6353 activity.

- [CVE-2026-20700](https://intel.threadlinqs.com/cve/CVE-2026-20700)
- [CVE-2025-43529](https://intel.threadlinqs.com/cve/CVE-2025-43529)
- [CVE-2025-43520](https://intel.threadlinqs.com/cve/CVE-2025-43520)
- [CVE-2025-43510](https://intel.threadlinqs.com/cve/CVE-2025-43510)
- [CVE-2025-31277](https://intel.threadlinqs.com/cve/CVE-2025-31277)
- [CVE-2025-14174](https://intel.threadlinqs.com/cve/CVE-2025-14174)
- [CVE-2024-23222](https://intel.threadlinqs.com/cve/CVE-2024-23222)
- [CVE-2023-43000](https://intel.threadlinqs.com/cve/CVE-2023-43000)
- [CVE-2023-42917](https://intel.threadlinqs.com/cve/CVE-2023-42917)
- [CVE-2023-42916](https://intel.threadlinqs.com/cve/CVE-2023-42916)
- [CVE-2023-41993](https://intel.threadlinqs.com/cve/CVE-2023-41993)
- [CVE-2023-41991](https://intel.threadlinqs.com/cve/CVE-2023-41991)
- [CVE-2023-41990](https://intel.threadlinqs.com/cve/CVE-2023-41990)
- [CVE-2023-41974](https://intel.threadlinqs.com/cve/CVE-2023-41974)
- [CVE-2023-41064](https://intel.threadlinqs.com/cve/CVE-2023-41064)
- [CVE-2023-41061](https://intel.threadlinqs.com/cve/CVE-2023-41061)
- [CVE-2023-38606](https://intel.threadlinqs.com/cve/CVE-2023-38606)
- [CVE-2023-37450](https://intel.threadlinqs.com/cve/CVE-2023-37450)
- [CVE-2023-32435](https://intel.threadlinqs.com/cve/CVE-2023-32435)
- [CVE-2023-32434](https://intel.threadlinqs.com/cve/CVE-2023-32434)
- [CVE-2023-32409](https://intel.threadlinqs.com/cve/CVE-2023-32409)
- [CVE-2023-32373](https://intel.threadlinqs.com/cve/CVE-2023-32373)
- [CVE-2023-28206](https://intel.threadlinqs.com/cve/CVE-2023-28206)
- [CVE-2023-28204](https://intel.threadlinqs.com/cve/CVE-2023-28204)
- [CVE-2023-23529](https://intel.threadlinqs.com/cve/CVE-2023-23529)
- [CVE-2023-23514](https://intel.threadlinqs.com/cve/CVE-2023-23514)
- [CVE-2022-48503](https://intel.threadlinqs.com/cve/CVE-2022-48503)
- [CVE-2022-46689](https://intel.threadlinqs.com/cve/CVE-2022-46689)
- [CVE-2022-42856](https://intel.threadlinqs.com/cve/CVE-2022-42856)
- [CVE-2022-32917](https://intel.threadlinqs.com/cve/CVE-2022-32917)
- [CVE-2021-30952](https://intel.threadlinqs.com/cve/CVE-2021-30952)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/UNC6353