On Thursday, the United Nations confirmed that they were hit with a cyber-attack that compromised their computer networks and several branches of their infrastructure. The attack occurred in April 2021 by a group of unknown threat actors, who were able to exfiltrate a massive number of sensitive documents which could be utilized to further attack agencies within the intergovernmental organization. The threat actors are believed to have purchased leaked credentials of a United Nations employee off of a dark web marketplace to utilize during the attack. Furthermore, the initial point-of-compromise was discovered to be within the United Nations project management software, Umoja, where employee accounts were not protected with dual-factor authentication. It was determined that threat actors compromised the network on April 5, 2021, and remained active within the network for 4 months, until August 7, 2021. Initial reports from the United Nations stated that no data was exfiltrated during the attack; however, an outside security firm determined that the threat actors did indeed exfiltrate sensitive documents. Should the threat actors be identified, CTAPT will provide an update on the situation at a later time.