UNC6586
UNC6586 is a suspected China-nexus cyber-espionage threat cluster. The provided reporting links the group to exploitation of the React Server Components vulnerability CVE-2025-55182 ("React2Shell") for initial access. In those incidents, UNC6586 retrieved a script via curl or wget that downloaded and executed the SNOWLIGHT downloader payload. SNOWLIGHT is described as a VShell stager or downloader/backdoor that makes HTTP GET requests to command-and-control infrastructure to retrieve additional payloads disguised as legitimate files. Google Threat Intelligence Group identified UNC6586 as one of multiple China-nexus clusters exploiting React2Shell globally. The content also notes SNOWLIGHT has been observed in intrusions attributed to UNC6586 as well as other China-nexus clusters including UNC5174 and UAT-6382. No additional aliases or sub-groups for UNC6586 are provided in the content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- CN
Tradecraft
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Associated vulnerabilities
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
Recent activity
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Threat cluster associated with use of the SNOWLIGHT VShell stager.
China-nexus APT cluster referenced as associated with SNOWLIGHT-linked intrusions.
Listed as a threat actor associated in the report’s aggregated section with exploitation activity around React2Shell (CVE-2025-55182) and related RSC/Next.js vulnerabilities.
Named in an aggregated list of actors associated with React2Shell (CVE-2025-55182) exploitation activity (UNC-style naming suggests an uncategorized cluster).
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.