UNC5221

UNC5221 is a suspected China-nexus, state-sponsored espionage threat cluster also tracked as UTA0178. The cluster is associated with targeted exploitation of internet-facing enterprise infrastructure, notably Ivanti Connect Secure zero-day vulnerabilities including CVE-2023-46805, CVE-2024-21887, CVE-2024-21893, and CVE-2025-0282. It exploited the first two Ivanti vulnerabilities before their public disclosure in December 2023 and subsequently conducted broader exploitation after disclosure. UNC5337 has been assessed as potentially overlapping with or forming part of UNC5221, while UNC5221 has also been publicly associated with Silk Typhoon; the latter relationship is not conclusively established. UNC5221-linked intrusions have used web shells, custom backdoors, KrustyLoader, Sliver, and the BRICKSTORM malware family. BRICKSTORM supports persistent access, file operations, network tunneling, proxying, and command-and-control communications designed to reduce network visibility, including DNS over HTTPS, WebSockets, nested TLS, and cloud-fronted infrastructure. Documented operations include exploitation for initial access, MFA bypass, session hijacking, use of compromised privileged credentials, reconnaissance of virtualized environments, lateral movement through RDP and SMB, deployment of persistent payloads, and data staging and exfiltration. Activity linked to UNC5221 has targeted U.S. organizations and European industries considered strategically relevant to the People’s Republic of China.