UNC5337
Suspected sponsor: China0
APAC targets
0
Techniques
0
Incidents
0
News · 30d
Profile
UNC5337 is a suspected China-nexus espionage actor that compromised Ivanti Connect Secure VPN appliances as early as Jan. 2024. UNC5337 is suspected to exploit CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection) for infecting Ivanti Connect Secure appliances. UNC5337 leveraged multiple custom malware families including the SPAWNSNAIL passive backdoor, SPAWNMOLE tunneler, SPAWNANT installer, and SPAWNSLOTH log tampering utility. Mandiant suspects with medium confidence that UNC5337 is UNC5221.
Related profiles: UTA0178
Profiles whose description names this actor, that this description names, or that share one of its names. The sources mention them together; they are not necessarily the same group.
ATT&CK techniques
MITRE ATT&CK has no technique mapping for this actor.
Incidents attributed
- No incident in the register is attributed to this actor.
In the news
- No Asia-Pacific article names this actor yet.
Targets
No victim countries in the sources.
Relevance to the EU
EU relevance: Low
No EU member state among its known victims and no overlap with EU projects
No EU cooperation projects recorded in its target countries.
References