Loading threat actor…
UNC5221, also tracked as UTA0178, is a China-nexus cyberespionage threat actor specializing in the compromise of internet-facing network appliances. Its documented activity dates to at least December 2023 and encompasses targeted intrusions and widespread exploitation across multiple countries. Targets include government and military organizations, defense contractors, telecommunications providers, technology companies, financial institutions, and industrial and professional-services organizations. The activity cluster formerly tracked as UNC5337 was subsequently merged into UNC5221. The group repeatedly exploits vulnerabilities in Ivanti Connect Secure and Policy Secure appliances and Citrix NetScaler ADC and Gateway products. Its campaigns include pre-disclosure exploitation of CVE-2023-46805 and CVE-2024-21887, zero-day exploitation of CVE-2025-0282 and CVE-2023-4966, and exploitation of CVE-2025-22457. After obtaining access, it deploys webshells, passive backdoors, credential harvesters, and tunneling tools. Associated malware includes GIFTEDVISITOR, ZIPLINE, LIGHTWIRE, CHAINLINE, FRAMESTING, WARPWIRE, DRYHOOK, PHASEJAM, and the SPAWN ecosystem. KrustyLoader has been used to retrieve and execute Sliver implants. TRAILBLAZE and BRUSHFIRE support in-memory deployment and passive command execution within appliance web processes. UNC5221 steals authentication credentials, appliance configurations, account databases, logs, and session data. Its post-exploitation activities include network reconnaissance, port scanning, proxying, and lateral movement using compromised accounts. SPAWN components provide persistent installation, SSH backdoor access, process injection, and traffic tunneling. The actor conceals intrusions by tampering with integrity-checking mechanisms, suppressing local and remote logging, deleting forensic artifacts, and modifying legitimate appliance components. It also uses compromised network appliances and routers as relay infrastructure to obscure intrusion origins. UNC5221 has been linked to the breach of F5's development and engineering knowledge-management environments, where attackers maintained persistent access and stole BIG-IP source code and information about undisclosed vulnerabilities.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
56 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
36 malware families attributed to this actor across reporting.
31 additional families tracked in Mallory.
19 CVEs this actor has used in observed campaigns. 19 of them exploited in the wild.
The threat actor was previously seen exploiting zero-days in ... Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282).
The threat actor was previously seen exploiting zero-days in ... Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282).
The threat actor was previously seen exploiting zero-days in ... Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282).
Armory Castle, previously known as UNC5221 or Warp Panda, reportedly exploited CVE-2026-102764 (CVSS 9.3) to take over self-hosted BeyondTrust Remote Support appliances and deploy the SAWFLY web shell, with activity dating to October 2023.
The Bushfire exploit targets critical vulnerabilities in Ivanti's VPN appliances (CVE-2025-0282, CVE-2025-0283, and CVE-2025-22457). The Bushfire payload was recently discovered in the wild and attributed to UNC5221.
14 more CVEs tied to this actor tracked in Mallory.
165 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Volexity-tracked activity cluster exploiting Ivanti Connect Secure and Policy Secure appliances to deploy web shells and JavaScript credential harvesters. The reporting characterizes the activity as likely espionage-motivated and state-linked, without identifying a sponsoring country. The content does not explicitly establish UTA0178 and UNC5221 as aliases.
A suspected China-nexus espionage group described as targeting strategically rather than opportunistically. The report tentatively attributes attacks against Ivanti appliances in late 2023 and early 2024 to UNC5221, involving exploitation of authentication-bypass and command-injection vulnerabilities to deploy Linux KrustyLoader and subsequently Sliver. The separate Windows KrustyLoader activity involving ScreenConnect is not explicitly attributed to UNC5221.
Referenced as a Chinese espionage group previously observed exploiting SAP product vulnerabilities, specifically CVE-2025-31324 affecting SAP products including SAP NetWeaver.
Mentioned as a China-linked APT group that previously exploited critical SAP flaws; not tied to the current CVE-2026-58231 exploitation in this article.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.