UNC5330Threat actor
UNC5330 is a suspected China-nexus espionage actor. UNC5330 has been observed chaining CVE-2024-21893 and CVE-2024-21887 to compromise Ivanti Connect Secure VPN appliances as early as Feb. 2024. Post-compromise activity by UNC5330 includes deployment of PHANTOMNET and TONERJAM.From MISP Galaxy
Last reported 18 days ago, by Huntress1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“An investigation into the impacted endpoint revealed that the threat actor behind the attack accessed the endpoint via Remote Desktop Protocol (RDP), disabled antivirus, and deployed Rclone for data exfiltration, before deploying the ransomware.”
- T1543.003Windows Service
“Shortly after, the threat actor accessed the BitDefender console, and several Windows services associated with the antivirus application were stopped:”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
hxxps://www.huntress.com/blog/mapping-akira-ransomware-attack“In 2024, Google Mandiant researchers reported that a suspected China-nexus actor, UNC5330, used a GOST proxy to help facilitate malicious tool deployment to endpoints, for instance.”
Indicators in its reports
named in the reports above- 64.227.4[.]134in 1 report
- 1f1bb322591b6d27…91600b600fbain 1 report
- d00833318a04caa0…4530a00bc3a4in 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.