Threat actor
UNC1802
Attribution profile
- Type
- Criminal
- Location
- United States of America
- Known incidents
- 1 incident
- Sources
- 0 sources
- First seen
- 2018-02-05
- Last seen
- 2018-02-05
- Updated
- 2026-10-14 01:53
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
UNC1802, also known by its alias, is a threat actor linked to the United States. In February 2018 it compromised the online portal of the University of Northern Colorado, using externally obtained Social Security numbers to reset employee passwords, gain access, and download W‑2 forms containing financial data. The breach was traced to an external source with no evidence of internal compromise. No further details on its broader targeting, tools, malware, or affiliations are publicly available.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 0 sources.