UNC5174

UNC5174 is a Chinese state-sponsored threat actor, widely assessed by multiple cybersecurity firms—including Mandiant, Sysdig, and HivePro—as operating on behalf of the Chinese government, potentially as a contractor for agencies such as the Ministry of State Security. The group is noted for its sophisticated cyber espionage operations and has been active since at least 2023.

Key Characteristics

• Targets: UNC5174 primarily targets Western countries such as the United States, Canada, and the United Kingdom, as well as organizations in the Asia-Pacific region. Victims include research institutions, government agencies, think tanks, technology companies, non-governmental organizations (NGOs), and critical infrastructure sectors such as energy, defense, and healthcare.
• Motivations: The group’s main objectives are espionage and intelligence collection, often prioritizing long-term persistence over destructive actions. There is also evidence that UNC5174 acts as an initial access broker, selling or brokering access to compromised environments to other actors.

Tactics, Techniques, and Procedures (TTPs)

• Initial Access: UNC5174 exploits vulnerabilities in public-facing applications, notably F5 BIG-IP and ConnectWise ScreenConnect, to gain initial access to target networks.
• Persistence: After gaining access, the group uses custom and open-source tools to establish and maintain long-term access.
• Custom and Open-Source Tools: UNC5174 has used custom malware such as SNOWLIGHT (a dropper for fileless payloads) and GOHEAVY, as well as open-source tools like SUPERSHELL and VShell (a Remote Access Trojan popular among Chinese-speaking cybercriminals).
• Defense Evasion: The group leverages living-off-the-land techniques and encrypted command and control (C2) channels, often using WebSockets over HTTPS to blend malicious traffic with legitimate network activity, making detection difficult.
• Domain Impersonation: UNC5174 uses domain squatting and impersonation (e.g., spoofing Cloudflare, Telegram, and Google domains) for phishing and social engineering.

Associated IP addresses