UNC4841Threat actor
- slime57
UNC4841 is a well-resourced threat actor that has utilized a wide range of malware and purpose-built tooling to enable their global espionage operations. They have been observed selectively deploying specific malware families at high priority targets, with SKIPJACK being the most widely deployed.From MISP Galaxy
Last reported 18 days ago, by The Hacker News1 report
Suspected originChinaMISP Galaxy
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan“In 2023, a China-nexus threat actor codenamed UNC4841 was observed exploiting two different vulnerabilities in Barracuda Email Security Gateway (ESG) appliances (CVE-2023-2868 and CVE-2023-7102) to deliver persistent backdoors.”
Indicators in its reports
named in the reports above- mx.zxopfds[.]comin 1 report
Copy this indicator · defanged
Thanks — we review every report.