QuietCrabs

QuietCrabs, also tracked as UNC5221, UTA0178, and Red Dev 61, is a cyberespionage threat actor first identified in January 2024. It targets organizations internationally, including in Russia, the United States, the United Kingdom, Germany, South Korea, Taiwan, the Philippines, Iran, and the Czech Republic. Its operations emphasize rapid exploitation of internet-facing enterprise systems and prolonged access to compromised networks. The group conducts mass internet scanning to identify vulnerable servers and exploits flaws in Microsoft SharePoint and Ivanti products. Associated vulnerabilities include CVE-2025-53770 in SharePoint, CVE-2025-4427 and CVE-2025-4428 in Ivanti Endpoint Manager Mobile, CVE-2024-21887 in Ivanti Connect Secure, and CVE-2023-38035 in Ivanti Sentry. Observed campaigns exploited newly disclosed vulnerabilities within hours to a day of public exploit availability. Following compromise, QuietCrabs deploys web shells and loaders to execute KrustyLoader and Sliver command-and-control implants. Its tooling includes ASPX web shells and JSP loaders. KrustyLoader is a Rust-based loader that retrieves and decrypts payloads before injecting them into other processes. Its evasion features include control-flow flattening, encrypted payload locations, execution-environment checks, executable relocation, and deletion of the original executable. Both Windows KrustyLoader samples and Sliver payloads have been recovered from its intrusions. The group also performs post-compromise reconnaissance, including checking external network information and file-write permissions.