Sabbath

Management summary

Sabbath is linked in public threat analysis to an actor cluster that was previously followed by names, including UNC2190 and Arcane. For visitors it is especially relevant that such clusters do not always operate neatly under one brand.

The core of the risk is hands-on-keyboard ransomware: an actor who uses access to explore internally, expand privileges, collect data, disrupt security and then deploy encryption or publication pressure.

For decision making, this means that a Sabbath-like threat cannot be solved with only antivirus or backups. Identity, remote access, logging, data viability and recovery architecture must be assessed together.

Grouping and development

Mandiant described Sabbath as a rebrand or continuation of previously followed activity around UNC2190/Arcane. The group illustrates how ransomware brands can exchange while operators, access methods or practices remain partially identifiable.

Public reporting points to extortion with leak-site component and targeted intrusions. This makes victimisation important: claims can mean technical impact, data diode or both.

Operation and attack chain

Research starts at initial access and persistence. Check VPN, RDP, webshells, remote management, valid accounts, MFA-holes and external vendors. Sabbath-like intrusions require a timeline that starts days or weeks before encryption.

In the middle phase, you should search for discovery, credential access, multilateral movement, privilege escalation and security impairment. Think PowerShell, WMI, remote services, PsExec-like behavior, LSASS- access, group membership changes and disable EDR or logging.

Data diary and publication printing are crucial. Search for archives, staging directories, file share traversal, Rclone-like behavior, cloud uploads and outbound traffic that does not fit the normal business processes.

Known IOCs and artifacts

UseSabbath -IOC Rebrands are more stable than infrastructure: remote access, discovery, credential access, staging, exfiltration and impact preparation.

Artefacts may include ransom notes, leak-site claims, malware binaries, webshells, command-lines, security tool impairment and datataging folders.

Victim pattern and lessons

Sabbath is a lesson in actor continuity. A new name can come from existing operators. Organisations therefore need to detect behavior and not wait until a brand name is known.

Claims by industry partners are useful to control their own access routes and data risk. Especially organisations with broad Windows domains, a lot of remote management and weak logging are vulnerable.

How to arm yourself

Force MFA, limit remote access, use privileged access workstations or jump hosts and monitor all changes in privileged groups.

Make data diary stand visible with file access logging, cloud audit logs, proxy/firewalltelemetry and EDR. Publication printing can only be clearly indicated if data movement is visible.

Protect recovery: immutable/offline backups, separate backup accounts, logging backup console actions and recovery tests without confidence in the primary domain.

Identity, naming and attribution

For Sabbath, the operational starting point is an exact identity match. The local dossier records the following names or aliases: Sabbath ransomware, UNC2190, Arcane. An alias is a search aid, not independent evidence of shared operators. Similar names, reused logos and the same extortion vocabulary cannot establish a relationship between groups. Analysts should retain the original spelling of a claim and distinguish the publisher, malware family and suspected intrusion operator. Those roles can belong to different people. This prevents an incident being assigned to the wrong group simply because a filename or public post resembles an earlier case. Any proposed relationship needs its own dated, attributable source.

Timeline and interpretation of dates

The source registry date available for Sabbath is 2021-11-22; the metadata snapshot was collected on 2026-09-15. These timestamps describe the available record, not a proven beginning of criminal operations. Registration may follow earlier activity, and a claim can concern an older incident. A defensible timeline separates suspected intrusion, data access, discovery by the victim, publication by the claimant and discovery by the monitoring service. The profile review date is another independent timestamp. Analysts should not silently convert one date into another. When sources disagree, preserve both observations and their provenance, then explain the uncertainty rather than presenting a falsely precise attack chronology.

Victim claims and targeting assessment

The victim panel for Sabbath shows up to five distinct organisations from the stored claim history. It is a moving observation window, not a complete incident census. Public listings can omit victims, repeat old material or exaggerate access. Consequently, a short run of organisations in one country or industry does not by itself prove deliberate targeting of that sector. The useful comparison is with the organisation's own dependencies: shared providers, remote access arrangements, exposed services and sensitive data flows. A supplier appearing in a claim justifies verification through established contacts, but does not establish that downstream customers were compromised. Separate confirmed statements from the claimant's assertions.

Evidence quality and confidence

The source material listed for Sabbath should be evaluated observation by observation. A technical report can substantiate a specific sample or incident without proving that every affiliate uses the same method. A leak-site description provides a different kind of evidence: it documents a public assertion, not the underlying access. Keep quotations, analyst interpretations and direct telemetry separate in working notes. Record which conclusion would change if a source were withdrawn or corrected. Confidence should follow the quality and independence of the evidence, not the prominence of the group name. Missing technical reporting is an intelligence gap; it is neither proof of sophisticated tradecraft nor proof that the actor is harmless.

Indicators of compromise (IOCs)

Indicators are historical observations, not proof of a current infection. Validate source, age and context before hunting or blocking; legitimate administrative tools can produce false positives.

Sources

• Mandiant: Sabbath ransomware / UNC2190 context
• MITRE ATT&CK — Valid Accounts (defensive context)
• MITRE ATT&CK — External Remote Services (defensive context)
• MITRE ATT&CK — Exfiltration Over Web Service (defensive context)
• MITRE ATT&CK — Inhibit System Recovery (defensive context)
• Ransomware.live — Sabbath

Evidence and limitations

Attribution describes the source assessment, not a verified identity. A leak-site listing alone does not prove encryption, data theft, a particular vulnerability or an affiliate relationship. Missing information is left explicit.