Loading threat actor…
UNC5337 is a suspected China-nexus cyber espionage actor associated with exploitation of Ivanti Connect Secure VPN appliances and deployment of the SPAWN malware ecosystem. The cluster has been linked to zero-day and n-day exploitation of Ivanti vulnerabilities beginning in early 2024 and continuing into 2025, with compromises observed as early as January 2024 and later activity involving exploitation of additional Ivanti flaws. UNC5337 is assessed to conduct espionage-oriented intrusions rather than financially motivated operations. The actor is known for using custom malware tailored to Ivanti appliances, including SPAWNSNAIL, SPAWNMOLE, SPAWNANT, and SPAWNSLOTH, and later activity involving updated SPAWN variants such as SPAWNCHIMERA and RESURGE has been reported in the same intrusion set. Associated tooling and payload delivery linked to UNC5337 activity has also included DRYHOOK and PHASEJAM. Reported functionality across this malware ecosystem includes installation, SSH backdoor access, SOCKS tunneling, proxying, and log wiping, indicating a focus on persistence, covert access, operational relay, and defense evasion on edge devices. Post-compromise tradecraft associated with the broader Ivanti exploitation activity includes use of valid accounts and living-off-the-land techniques, abuse of appliance-specific functionality, lateral movement into internal networks, and efforts to evade detection through monitoring bypass and log destruction. UNC5337 has been tied to campaigns affecting organizations across multiple countries and a wide range of sectors, including government, financial institutions, telecommunications, automotive, and chemical organizations. Multiple reporting streams assess UNC5337 as either overlapping with or likely part of the broader China-linked cluster UNC5221; some assessments state the two may be the same actor.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
8 malware families attributed to this actor across reporting.
3 additional families tracked in Mallory.
4 CVEs this actor has used in observed campaigns. 4 of them exploited in the wild.
"...installed by exploiting a zero-day vulnerability at that time, CVE-2025-0282, during attacks against organizations in Japan around December 2024..."; "CVE-2025-0282 refers to a critical security flaw in ICS that could allow unauthenticated remote code execution. It was addressed by Ivanti in early January 2025."
Since the initial disclosure of CVE-2023-46805 and CVE-2024-21887 on Jan. 10, 2024... Mandiant is tracking multiple clusters of activity exploiting CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893... UNC5337 is suspected to exploit CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection) for infecting Ivanti Connect Secure appliances.
Since the initial disclosure of CVE-2023-46805 and CVE-2024-21887 on Jan. 10, 2024... Mandiant's previous blog post details zero-day exploitation of CVE-2024-21893 and CVE-2024-21887... UNC5337 is suspected to exploit CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection) for infecting Ivanti Connect Secure appliances.
Similarly, CVE-2025-22457 is also attributed to a stack-based buffer overflow weakness. This vulnerability impacts a range of Ivanti products, including Pulse Connect Secure 9.1x and Ivanti Connect Secure 22.7R2.5 and earlier... Ivanti released a patch for this vulnerability on February 11, 2025.
3 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
UNC5337 is a China-nexus threat actor known for exploiting edge-appliance vulnerabilities (notably Ivanti Connect Secure CVE-2025-0282/0283) to gain access to networks, leading to operational downtime and requiring extensive remediation.
China-nexus cyber espionage activity exploiting Ivanti Connect Secure (ICS) CVE-2025-0282 (as a zero-day) to deploy the SPAWN malware ecosystem and related tooling (DRYHOOK, PHASEJAM).
China-linked cyber espionage activity targeting Ivanti Connect Secure VPN appliances by exploiting critical stack buffer overflow vulnerabilities to gain remote code execution and deploy the SPAWN* malware toolkits (e.g., SPAWNCHIMERA modules) for persistence, tunneling, backdoor access, and log wiping.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.