Loading threat actor…
UNC5330 is a suspected China-nexus espionage threat actor active at least since 2021 and publicly associated with exploitation of Ivanti Connect Secure vulnerabilities in 2024. The actor has been observed chaining CVE-2024-21893 and CVE-2024-21887 to compromise Ivanti Connect Secure VPN appliances as early as February 2024, followed by post-compromise activity on Windows environments. Reported follow-on tradecraft includes deployment of the malware families PHANTOMNET and TONERJAM, use of Windows Management Instrumentation for reconnaissance, lateral movement, registry manipulation, and persistence, and use of proxying infrastructure to facilitate malicious tool delivery to downstream endpoints. UNC5330 has also been linked to abuse of Active Directory Certificate Services ESC1 misconfigurations for domain escalation after Ivanti appliance compromise, enabling certificate-based impersonation of privileged accounts and durable access. Tentative reporting has also linked tooling associated with the Grager backdoor to UNC5330. Overall, UNC5330 is characterized as an espionage-oriented intrusion cluster focused on initial access through edge-device exploitation, followed by internal discovery, privilege escalation, persistence, and broader post-exploitation within victim enterprise networks.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
10 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
Since the initial disclosure of CVE-2023-46805 and CVE-2024-21887 on Jan. 10, 2024... Mandiant's previous blog post details zero-day exploitation of CVE-2024-21893 and CVE-2024-21887... UNC5337 is suspected to exploit CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection) for infecting Ivanti Connect Secure appliances.
Mandiant's previous blog post... details zero-day exploitation of CVE-2024-21893 and CVE-2024-21887 by a suspected China-nexus espionage actor that Mandiant tracks as UNC5325... UNC5330 has been observed chaining CVE-2024-21893 and CVE-2024-21887 to compromise Ivanti Connect Secure VPN appliances as early as Feb. 2024.
8 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Reportedly chained exploitation of Ivanti vulnerabilities with subsequent ADCS ESC1 abuse to escalate privileges to domain-level control.
Suspected China-nexus espionage actor tentatively linked to the Grager activity chain via shared Tonerjam launcher artifacts; known for exploiting Ivanti Connect Secure VPN vulnerabilities in early 2024.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.