- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sources
- 3 sources carry it
- Identifier
- GINC-APT-1039 · unc5337
ChinaWhat it is
UNC5337 is a suspected China-nexus espionage actor that compromised Ivanti Connect Secure VPN appliances as early as Jan. 2024. UNC5337 is suspected to exploit CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection) for infecting Ivanti Connect Secure appliances. UNC5337 leveraged multiple custom malware families including the SPAWNSNAIL passive backdoor, SPAWNMOLE tunneler, SPAWNANT installer, and SPAWNSLOTH log tampering utility. Mandiant suspects with medium confidence that UNC5337 is UNC5221.
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Tools
The tools and malware families the sources tie to it.
- Backdoor.Oldrea
- China Chopper
- Xploit
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de