UNC5221
UNC5221 is a suspected China-nexus espionage actor, also referenced as UTA0178. Reporting in the provided content consistently links the cluster to exploitation of edge and infrastructure technologies, especially Ivanti Connect Secure and Policy Secure appliances, VMware and vCenter infrastructure, and other appliances that often lack traditional EDR coverage. Multiple sources describe UNC5221 as focused on long-term, low-visibility access, with one report noting average dwell times of 393 days in BRICKSTORM-linked intrusions and another describing at least 18 months of access to a victim’s VMware vCenter servers during source-code theft operations. The actor is described as leveraging zero-day and n-day exploitation, including repeated exploitation of Ivanti vulnerabilities. The content states UNC5221 exploited two separate zero-day vulnerabilities in the same VPN product over a three-month period, used CVE-2025-22457 for remote code execution from at least mid-March 2025, and has been characterized as notorious for exploiting Ivanti zero-days against government agencies. Mandiant assessed UNC5221 likely identified CVE-2025-22457 by analyzing a February patch. The content also associates the cluster with broader edge-device targeting and sophisticated operational tradecraft, including in-memory malware to reduce disk artifacts and tunneling command-and-control traffic through legitimate third-party services. Malware and tooling directly linked to UNC5221 in the content include the SPAWN malware ecosystem and related tooling such as SPAWNANT, PhiliKit, and passive backdoors; LIGHTWIRE, THINSPOOL, WARPWIRE, WIREFIRE, and ZIPLINE; BRICKSTORM; BRUSHFIRE; TRAILBLAZE; and tooling overlaps involving KrustyLoader. PhiliKit is described as a passive backdoor capable of executing shell commands, Python scripts, and Perl scripts, and ESET assessed it to be part of UNC5221’s SPAWN toolset targeting Ivanti VPN appliances. ZIPLINE is described as a passive backdoor. BRUSHFIRE is described as a passive backdoor, and TRAILBLAZE as an in-memory dropper. BRICKSTORM is repeatedly associated with UNC5221 and closely related China-nexus clusters and is described as a stealthy backdoor deployed on network appliances and VMware infrastructure. Targets mentioned in the content include government agencies, legal organizations, technology companies, and infrastructure/appliance environments. The content states UNC5221-linked activity targeted Ivanti VPN appliances, government agencies, U.S. legal sector organizations for information related to national security and international trade, and technology companies, likely to support future operations including exploit development. Additional reporting links UNC5221 or UNC5221-related activity to attacks involving VMware infrastructure, MITRE, and source-code theft. One report also notes a low-confidence link between UNC5221 and the August 2025 compromise of F5 internal engineering and development infrastructure. The content notes that UNC5221 is often conflated with Silk Typhoon and has at times been used synonymously with that actor in public reporting, but Google Threat Intelligence Group does not currently assess them to be the same cluster. The content also notes overlaps between UNC5221 and UNC6201, but states they are not currently assessed as the same cluster. Known alias in the provided content: UTA0178.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- CN
Tradecraft
49 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
31 malware families attributed to this actor across reporting.
26 additional families tracked in Mallory.
Associated vulnerabilities
14 CVEs this actor has used in observed campaigns. 14 of them exploited in the wild.
This is an Ivanti exploit, possibly for CVE-2025-0282, CVE-2025-0283, or CVE-2025-22457 and the payload installs a backdoor. Mandiant recently discovered the payload in the wild. They attribute the activity to UNC5221, a suspected China-nexus espionage actor.
This is an Ivanti exploit, possibly for CVE-2025-0282, CVE-2025-0283, or CVE-2025-22457 and the payload installs a backdoor. Mandiant recently discovered the payload in the wild. They attribute the activity to UNC5221, a suspected China-nexus espionage actor.
CVE-2023-46805 is an authentication bypass vulnerability in the web component of Ivanti Connect Secure (ICS), previously known as Pulse Connect Secure and Ivanti Policy Secure. This vulnerability allows an attacker to bypass control checks and access restricted resources.
CVE-2024-21887 is a command injection vulnerability in the web component of Ivanti ICS and Policy Secure that can be abused to execute arbitrary commands by an authenticated user.
Dell 0-Day Vulnerability A critical zero-day exploitation campaign targeting Dell RecoverPoint for Virtual Machines. The vulnerability, tracked as CVE-2026-22769, carries a maximum CVSSv3.1 score of 10.0 and has been under active exploitation since at least mid-2024.
9 more CVEs tied to this actor tracked in Mallory.
Observables
73 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Chinese hacking group linked to the PhiliKit passive backdoor and previously associated with the SPAWN malware suite.
Associated with the SPAWN toolset and targeting Ivanti VPN appliances using the PhiliKit implant.
Suspected link to the compromise of F5 Networks’ internal engineering and development infrastructure, including exfiltration of source code, bug-tracking data, undisclosed vulnerability information, and limited customer configuration details.
Sophisticated cluster exploiting repeated zero-days in a VPN product, using in-memory malware and covert C2 tunneling through legitimate services.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.