Loading threat actor…
UNC5266 is a China-nexus intrusion cluster tracked for post-disclosure exploitation of Ivanti Connect Secure vulnerabilities, including CVE-2023-46805, CVE-2024-21887, and related activity leading to deployment of Bishop Fox’s SLIVER framework, a WARPWIRE variant, and the TERRIBLETEA malware family. The cluster is assessed with moderate confidence to partially overlap with UNC3569, a China-nexus espionage actor previously associated with exploitation of enterprise-facing applications for initial access. Reporting also indicates malware infrastructure overlap between UNC5266 and the Chinese state-sponsored espionage actor RedNovember, suggesting shared or overlapping infrastructure among China-linked operations. UNC5266’s observed tradecraft centers on exploitation of internet-facing edge infrastructure for initial access, followed by post-exploitation activity designed to establish footholds and enable follow-on operations. The cluster has been associated with deployment of custom malware and offensive frameworks after compromise of Ivanti appliances. Available reporting supports characterization of UNC5266 as an espionage-oriented actor or cluster rather than a ransomware or financially motivated operation.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
Since the initial disclosure of CVE-2023-46805 and CVE-2024-21887 on Jan. 10, 2024... Mandiant is tracking multiple clusters of activity exploiting CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893... UNC5337 is suspected to exploit CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection) for infecting Ivanti Connect Secure appliances.
Since the initial disclosure of CVE-2023-46805 and CVE-2024-21887 on Jan. 10, 2024... Mandiant's previous blog post details zero-day exploitation of CVE-2024-21893 and CVE-2024-21887... UNC5337 is suspected to exploit CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection) for infecting Ivanti Connect Secure appliances.
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Chinese activity cluster referenced as having overlapping malware infrastructure with RedNovember; no additional operations described in the content.
Chinese activity cluster referenced as having overlapping malware infrastructure with RedNovember; no additional operations described in the content.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.