UTA0178Threat actor
- red dev 61
- UNC5221
While Volexity largely observed the attacker essentially living off the land, they still deployed a handful of malware files and tools during the course of the incident which primarily consisted of webshells, proxy utilities, and file modifications to allow credential harvesting.From MISP Galaxy
Last reported 5 days ago, by Rapid710 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1505.003Web Shell
“Mandiant's investigation describes arbitrary file uploads, deployment of the SAWFLY PHP web shell and BARECLAW tunneler, root escalation, attempted credential-vault extraction, persistence, and log deletion.”
- T1542.003Bootkit
“…Boots y MoKhargosh, demostraron tanto capacidades de ciberespionaje como potencial destructivo —incluido el despliegue de un wiper tipo bootkit y la retención de herramientas destructivas para su uso posterior—, mientras que un tercero, MOØN Badr, parece haber estad…”
- T1195Supply Chain Compromise
“…yptocurrency ecosystem with social engineering schemes that can yield both direct financial gain and opportunities for software supply-chain compromise.”
- T1213.003Code Repositories
“The agents found their way in through credentials and connection settings left exposed in app configurations, public code repositories, and overly permissive cloud roles.”
- T1485Data Destruction
“Particularly notable was a December 2025 data destruction incident affecting a Polish energy company, which we attribute to Sandworm with medium confidence.”
- T1552.004Private Keys
“…ions by replacing the destination address with an attacker-controlled wallet and harvesting wallet material, such as seed phrases and private keys.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
10 reports, newest first · the exact sentence from each-
CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild“Mandiant attributes the activity to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221.”
-
⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More“BeyondTrust Remote Support Flaw Exploited as 0-Day — The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026.”
-
Prolific Chinese espionage group exploits BeyondTrust zero-day“Mandiant researchers said a likely Chinese government-backed espionage group it previously tracked as UNC5221, and now calls Armory Castle, exploited the critical defect — CVE-2026-102764 — then showcased multiple tactics to escalate privileges, hop around the compromised network…”
-
CVE-2026-102764: BeyondTrust Zero-Day Exploited“Researchers attribute the activity to ARMORY CASTLE, formerly tracked as UNC5221, a suspected PRC-nexus espionage actor known for targeting edge appliances.”
-
Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day“…telligence Group (GTIG), CVE-2026-102764 has been exploited as a zero-day by Armory Castle, a China-linked threat actor also tracked as UNC5221 and Warp Panda.”
-
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers“The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026.”
-
ARMORY CASTLE Exploits BeyondTrust“…response engagement, Mandiant identified evidence that ARMORY CASTLE, a suspected PRC-nexus espionage threat actor (formerly tracked as UNC5221), exploited this vulnerability as a zero-day, in late August 2026.”
-
VerdantBamboo: Just Another BRICKSTORM in the Firewall“Ultimately, Volexity’s analysis revealed that a Chinese threat actor, which Volexity tracks as VerdantBamboo (WARP PANDA, UNC5221), had compromised the Storage Sync system.”
-
Reporte de Actividad APT del cuarto trimestre de 2025 al primero de 2026“En VirusTotal identificamos PhiliKit, un nuevo implante que evaluamos como parte del conjunto de herramientas SPAWN de UNC5221, orientado a dispositivos VPN de Ivanti.”
-
ESET APT Activity Report Q4 2025–Q1 2026“On VirusTotal we found PhiliKit, a new implant that we assess to be part of UNC5221’s SPAWN toolset targeting Ivanti VPN appliances, while our tracking of NegativeGlimmer revealed the group compromising governmental entities in Cambodia and Panama, as well as an AI and robotics c…”
Indicators in its reports
named in the reports above- dc14e215269a93fd…96a6f2ae95fbin 3 reports
- 1f19b9a27d79c11b…d0307e3aa462in 3 reports
- 98ee964edeb5a988c3bba8ea1e57fe0ein 1 report
- e952c18272efa1c3…f443c02743fein 1 report
- ee41e06ed96182ce…842d39b99b0ain 1 report
- 58d4eccc982c9e9b1b98aa62c514e53ain 1 report
- f4d77958a12a0778…b18f82e332c4in 1 report
- 40d264cf9c739239…ca46e6067bf5in 1 report
- 84ad78b2bab946c3677fdc28ebd8a774in 1 report
- 681075027553546c…f84633dcffcein 1 report
- f70abe93112637d3…fc17a8f8a264in 1 report
- 95dc2289427ed29b8b996d0e3d1b78cbin 1 report
- f8d93c1769e877aa…67b5ae371c7ain 1 report
- eb141a4395880272…c0a1be326e2ein 1 report
- host[.]servicesin 1 report
- e28a96f983b8605d…0e5ad7d6cec0in 1 report
Copy these 16 indicators · defanged
Thanks — we review every report.