Loading threat actor…
UNC5330 is a suspected China-nexus cyberespionage actor observed compromising Ivanti Connect Secure VPN appliances as early as February 2024. Its initial-access activity chained CVE-2024-21893, a server-side request forgery vulnerability, with CVE-2024-21887, a command injection vulnerability. Following compromise, UNC5330 deployed PHANTOMNET and TONERJAM. TONERJAM decrypts and executes locally stored, encrypted shellcode payloads. The actor used Windows Management Instrumentation for reconnaissance, lateral movement, registry manipulation, and persistence. Its supporting infrastructure included a GOST proxy used to facilitate malicious tool deployment to endpoints, and it attempted to retrieve Fast Reverse Proxy from a compromised VPN appliance. UNC5330 has also used Active Directory Certificate Services ESC1 certificate-template abuse for domain privilege escalation after exploiting Ivanti vulnerabilities. No additional aliases or subgroups are established.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
10 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 malware families Mallory has associated with this actor across public reporting.
2 CVEs Mallory has associated with this actor across public reporting. 2 of them are exploited in the wild (not necessarily by this actor).
8 indicators attributed to this actor. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.