threat actor · Origin not attributed
UNK_DoubleCheck
3 CVEs exploited (3 in CISA KEV)
The strips, in order: the CVEs it is reported to exploit by weakness class and by vendor, the techniques ATT&CK says it uses by tactic, its malware and tools, then who it targets. Each square is one record.
Open UNK_DoubleCheck's actor pageUNK_DoubleCheck is named in three CyberSIXT articles about groups adopting the BlueMoon exploit kit. Proofpoint attributes its reported exploitation of CVE-2026-85046, CVE-2026-85880 and CVE-2026-87491 to the actor; little else is on record, and no origin is attributed.
Source: CyberSIXT summary, 14 November 2026. Written by CyberSIXT's model from CyberSIXT's own article summaries and records, and checked against them; read the articles before relying on it.
- Origin
- Not attributed
- On record in
- CyberSIXT
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.