Loading threat actor…
UNC4540 is a suspected China-nexus cyber espionage threat actor tracked for targeting unpatched SonicWall Secure Mobile Access (SMA) appliances. The actor is associated with long-term post-compromise persistence on edge devices and the use of custom malware tailored specifically to SonicWall environments. Observed tooling included a TinyShell backdoor variant, an ELF component, and multiple Bash scripts engineered to provide privileged shell access, steal credentials, and survive reboots and firmware upgrades. UNC4540’s operations against SonicWall SMA appliances demonstrated detailed knowledge of the platform’s internals. The malware queried appliance session databases to obtain usernames and hashed credentials for offline cracking, launched reverse-shell access, and used redundant watchdog-style mechanisms so components could restart one another if interrupted. The actor also modified legitimate appliance functionality to improve operational stability and maintain access during shutdown and restart events. A notable characteristic of UNC4540 is persistence through firmware updates. The actor monitored for newly staged firmware images, altered upgrade packages to reinsert malware before installation, and added a backdoor account so access would survive subsequent upgrades. Evidence indicates some compromises may have begun as early as 2021 and remained resident through multiple firmware update cycles. The activity aligns with a broader pattern of Chinese espionage-oriented intrusion sets targeting internet-facing network appliances as an initial foothold for deeper enterprise intrusion. In UNC4540’s observed operations, the strongest directly supported behaviors are initial access against exposed edge infrastructure, credential theft, persistence, post-exploitation, and defense-evasion through appliance-specific modifications and upgrade hijacking.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
10 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Targeted SonicWall Secure Mobile Access (SMA) appliances, deploying custom malware designed to persist even after firmware upgrades (suggesting a focus on durable access to edge devices for follow-on operations).
Targeting unpatched SonicWall SMA appliances to install custom malware for long-term persistence, credential theft, reverse shell access, and cyber espionage.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.