Volexity: UTA0560 shares shellcode with activity attributed to APT31

Volexity reported that the UTA0560 cluster uses the same shellcode as activity attributed to APT31 and tracked elsewhere as TA412. A shared binary artefact may indicate one group, tool reuse, deliberate planting, or a common third-party builder.

• UTA0560 and APT31/TA412 share identical shellcode
• Matching bytes show a relationship but not a single group
• Four explanations: one team, resale, planting, shared builder
• Defenders should hunt loader behaviour, not shellcode hashes