Threat actor
UNC6993
Tracked by CyberSIXT since 3 Nov · RSS
1Articles, all time
1Articles, last 30 days
0CVEs exploited, attributed · all time
0Research reports, all time
Activity
Developinglatest 2 hours ago1 article1 outlet
One article so far, 3 Nov. A pattern appears once more outlets cover UNC6993.
- Tue 3 Nov. The Hacker News. Google reports LLMjacking attacks driving cloud bills to $1 million.
- CVE not in KEV
- Article naming UNC6993
- Articles a day, all coverage
Drawn: the only article.
Show as tableHide table
| Date | Type | Source | Title |
|---|---|---|---|
| 3 Nov | Article | The Hacker News | Google reports LLMjacking attacks driving cloud bills to $1 million |
CVEs exploited
No CVE is attributed to UNC6993 in CyberSIXT coverage.
MITRE ATT&CK techniques
No MITRE ATT&CK® techniques are recorded for UNC6993.
CVEs named alongside1
These articles name both the actor and the CVE. They do not attribute exploitation of these CVEs to UNC6993.
BerriAI LiteLLM vulnerability
8.8High16% EPSS · 3 articles
Articles1
Drawn: the only article.
- Google reports LLMjacking attacks driving cloud bills to $1 millionThe Hacker NewsCVE-2026-40217