Status

Active

Distinct actor

MODERATE 78%

Named actor

INSUFFICIENT

First observed

25 May 2026

Last updated

25 May 2026

Operator language

Turkish-speaking, Turkish-located

Motivation

Intelligence collection; no monetisation found across 780 operator files

Note on UTA identifiers: "UTA" stands for Unattributed Threat Actor. UTA-2026-013 is a tracking label The Hunters Ledger assigns to an actor I have observed but cannot yet link to a publicly named threat group. Other vendors and feeds will not use this label; it is specific to this publication. If later evidence ties the activity to a named actor, I will retire the label and update the report.

Summary

A custom analytics platform built on an AI agent framework that ingested four stolen observability sources from one Turkish financial-sector victim over a 73-day dwell, alongside operator-authored documentation guiding an in-network insider. The report names no individual, treats the operator's handle as an indicator only, and leaves the state-aligned versus factional question unresolved.

The confidence levels above are the published report's figures. Every claim on this page is a summary of the linked reports, which remain the record.

Targeting

Targeting is given as region and sector, drawn from the reports. Victim names are deliberately not published here or in the reports.

Reports

Actor identifiers

Artifacts this operator chose or created: handles, channels, operator brands and domains, wallets and the like. Each is printed in a report linked above; the full indicator set, with its caveats, is in each report's IOC feed.

Infrastructure and tooling

Primary host

209.38.205.158 (the operator-controlled host the assigning report is named for; the full indicator set, with its caveats, is in each report's IOC feed)

Tooling

OpenClawcustom ARPA correlation platformTimescaleDBNeo4j

MITRE ATT&CK

17 techniques across 10 tactics, read from the mapping tables of the reports about this actor, which keep their mapping on the companion detection page. Each technique links to where it is mapped.

Related designations

• UTA-2026-015: Both use the same AI agent platform; assessed an ecosystem signal, not coordination.

Actor profiles and the reports behind them are © Joseph, The Hunter's Ledger, licensed CC BY 4.0: free to use, including commercially, with attribution. All tracked actors.