UNC5174Threat actor
- uteus
UNC5174, a Chinese state-sponsored threat actor, has been identified by Mandiant for exploiting critical vulnerabilities in F5 BIG-IP and ScreenConnect. They have been linked to targeting research and education institutions, businesses, charities, NGOs, and government organizations in Southeast Asia, the U. S., and the UK.From MISP Galaxy
Last reported 27 days ago, by CERT-EU4 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1014Rootkit
“…able Roundcube servers to relay C2 traffic and also exploited CVE-2026-68820, a zero-day vulnerability in Windows to deploy a FudModule rootkit.”
- T1195Supply Chain Compromise
“In regards to cybercrime, we noted a Rust crates supply-chain compromise via typosquatted dependency, with infrastructure overlapping with operations attributed to North Korea-linked threat actors.”
- T1505.003Web Shell
“Activity spanned over 100 countries and led to confirmed compromises, including administrative takeovers and web shell deployments, enabling follow-on access and potential credential theft.”
- T1684Social Engineering
“On the cyberespionage front, two Russia-linked APTs targeted EU countries with spearphishing and social engineering, and North Korea-linked threat actor Lazarus' continued its Operation Dream Job.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Cyber Brief 26-09 - August 2026“On July 31, SOCRadar reported a China-nexus Snowlight campaign linked to access brokers UNC5174/UNC6586.”
-
Someone's attacking a critical 0-day RCE in F5 BIG-IP APM“…up or country, but a year earlier Google's Mandiant threat hunters linked exploitation of the critical F5 BIG-IP flaw CVE-2023-46747 to UNC5174, an access broker it assessed with moderate confidence as operating from China.”
-
Advent of Configuration Extraction, Part 3: SNOWLIGHT Config“It has been incorporated into UNC5174 campaigns as an in-memory loader for the VShell remote access trojan.”
-
Multiple Threat Actors Rapidly Exploit React2Shell: A Case Study of Active Compromise“… addition to typical financially motivated coin miners, the following were also observed: a SNOWLIGHT [1] downloader reportedly used by UNC5174, a Golang-based HISONIC backdoor [2] reportedly used by UNC6603, and CrossC2 RAT [3], the Linux version of the Cobalt Strike implementat…”
Indicators in its reports
named in the reports above- 344c391cfd4fd304…b3c6c4cbbb29in 1 report
- rel.symbol[.]namein 1 report
- symbol[.]namein 1 report
- instr[.]idin 1 report
- 154.89.152[.]240in 1 report
- hxxps://github[.]com/hackerschoice/gsocketin 1 report
- hxxps://sect.iij.ad[.]jp/blog/2025/11/unc5174-windows-snowlight-in-2025/in 1 report
- sect.iij.ad[.]jpin 1 report
- 45.143.131[.]123in 1 report
- 5bae25736a09de5f…9d021a65daa9in 1 report
- ba43e447e63611d3…9ccf6169808bin 1 report
- ac3e12fa0aa4d6e4…9d3b3a6c2fb8in 1 report
- a536d755313ce550…3c496c8fcd12in 1 report
- 0c748b9e8bc6b5b4…6a19d4f9b657in 1 report
- 1a1edbea47162b1a…6a04b7c15552in 1 report
- 0d07a97499322130…e830a2d82729in 1 report
- 5baa52387daedea5…e8e4a423baafin 1 report
- c1a9cfc62626118b…9ea5c987fcc0in 1 report
- 4a74676bd00250d9…17f58fc9f85cin 1 report
- cb5f62bf7b591e69…f02e403d2e78in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.