UNC5325

UNC5325 is a suspected China-nexus cyber espionage actor associated with exploitation of Ivanti Connect Secure vulnerabilities in early 2024, including CVE-2024-21893 and CVE-2024-21887. The actor has been linked to zero-day and mitigation-bypass activity against Ivanti appliances and has been observed using living-off-the-land techniques, open-source tooling, custom malware, and appliance configuration changes to evade detection and establish persistence. UNC5325 deployed multiple malware families and components, including LITTLELAMB.WOOLTEA, PITSTOP, PITDOG, PITJET, and PITHOOK. Its tradecraft included attempts to maintain access across upgrades, patches, and factory resets, indicating a strong focus on durable post-compromise persistence on edge infrastructure. Reported persistence attempts were not successful in observed cases because of a malware logic issue involving encryption key mismatch, but the activity demonstrated deliberate efforts to survive remediation. The actor is assessed as espionage-motivated and China-linked. Malware-code and TTP overlaps have been identified between UNC5325 tooling, particularly LITTLELAMB.WOOLTEA and PITHOOK, and malware associated with UNC3886. This supports a moderate-confidence assessment that UNC5325 is associated with UNC3886. UNC3886 has been known for intrusions against network devices and for targeting defense industrial base, technology, and telecommunications organizations, which provides additional context for UNC5325’s likely operational alignment. Observed UNC5325 activity centered on compromising Ivanti Connect Secure appliances, including use of a mitigation bypass for CVE-2024-21893 and chaining of vulnerabilities to obtain unauthenticated access and command execution. The actor’s use of stealthy post-exploitation methods and persistence-oriented malware on perimeter devices is consistent with a sophisticated espionage operator focused on covert access.