UNC5174
UNC5174 is classified as hacktivist.
- Malware families
- 2
- Also known as
- 1
UNC5174, a Chinese state-sponsored threat actor, has been identified by Mandiant for exploiting critical vulnerabilities in F5 BIG-IP and ScreenConnect. They have been linked to targeting research and education institutions, businesses, charities, NGOs, and government organizations in Southeast Asia, the U.S., and the UK. UNC5174 is believed to have connections to China's Ministry of State Security and has been observed using custom tooling and the SUPERSHELL framework in their operations. The actor has shown indications of transitioning from hacktivist collectives to working as a contractor for Chinese intelligence agencies.
The group is associated with 2 malware families.
Also known as: Uteus
The group is associated with 2 malware families.
Malware families
- GOREVERSE
- SNOWLIGHT
Published reports on this actor:
- https://rhisac.org/threat-intelligence/f5-big-ip-and-screenconnect-cves/
- https://www.mandiant.com/resources/blog/initial-access-brokers-exploit-f5-screenconnect
Source: MISP Galaxy, Malpedia.
What does a hacktivist do?
Hacktivist groups choose targets based on political and current events. Denial-of-service (DDoS) attacks, website defacements and publication of stolen data are common; announcements are made on Telegram channels.
Which defenses matter most?
- Use denial-of-service protection and a content delivery network for your website and APIs.
- Keep your content management system and plugins updated, and do not expose the admin panel to the internet.
- Monitor announcement channels: target lists are shared before attacks.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.