UNC4540
UNC4540 is a suspected Chinese cyber espionage threat actor tracked by Mandiant. The actor has been observed targeting unpatched SonicWall Secure Mobile Access (SMA) appliances, with evidence that some infections may date back to 2021. Mandiant and SonicWall PSIRT reported that UNC4540 used a custom malware suite tailored for SonicWall devices to obtain highly privileged access, steal credentials, maintain shell access, and persist through reboots and firmware upgrades. Observed tooling includes a primary bash-based malware component named "firewalld," a redundant backup script named "iptabled," a firmware-manipulation script named "geoBotnetd," a shutdown-related script named "ifconfig6," and a TinyShell backdoor variant deployed as "/bin/httpsd." The malware queried the appliance session SQLite database to steal usernames and hashed passwords of logged-in users, storing the results in "/tmp/syslog.db" for later offline cracking. It also launched TinyShell in reverse-shell mode to provide attacker access. UNC4540 implemented multiple persistence mechanisms. The malware used "/etc/rc.d/rc.local" for startup persistence, had redundant watchdog-style scripts that restarted each other if one failed, patched the legitimate SonicWall binary "firebased," and monitored for new firmware images at "/cf/FIRMWARE/NEW/INITRD.GZ." When new firmware was detected, the actor's tooling unpacked and modified the firmware image to reinsert the malware and added a backdoor root user named "acme" so access would survive firmware updates. Mandiant stated this firmware manipulation was observed post-exploitation on already infected devices and was not observed as a supply-chain attack. Mandiant said the exact initial infection vector was unclear, but assessed the targeted devices were unpatched and likely exposed to older vulnerabilities. Mandiant also noted similarities between this activity and broader Chinese targeting of internet-facing network appliances for initial access, persistence, and eventual enterprise intrusion. Known alias: UNC4540.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- CN
Tradecraft
10 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
4 malware families attributed to this actor across reporting.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Targeted SonicWall Secure Mobile Access (SMA) appliances, deploying custom malware designed to persist even after firmware upgrades (suggesting a focus on durable access to edge devices for follow-on operations).
Targeting unpatched SonicWall SMA appliances to install custom malware for long-term persistence, credential theft, reverse shell access, and cyber espionage.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.