UNC5337

UNC5337 is a suspected China-linked, China-nexus cyber espionage threat actor associated with exploitation of Ivanti Connect Secure VPN appliance vulnerabilities, particularly CVE-2025-0282 as a zero-day. Reporting links UNC5337 to delivery of the SPAWN malware ecosystem, including custom Spawn malware and updated SPAWN variants, and to use of additional tools such as DRYHOOK and PHASEJAM in connection with this exploitation. Mandiant-associated reporting describes UNC5337 activity as likely part of a broader cluster tracked as UNC5221. TeamT5 and other reporting describe the activity as a widespread espionage campaign affecting organizations across 12 countries and nearly 20 industries, including automotive, chemical, government, financial institutions, and telecommunications. The actor’s tradecraft includes exploitation of edge VPN appliances for initial access and remote code execution, pivoting into internal networks, use of layered command-and-control, evasion of monitoring, and log wiping. Malware associated with the broader SPAWN ecosystem in this context includes SPAWNCHIMERA and modules such as SPAWNANT, SPAWNMOLE, SPAWNSNAIL, and SPAWNSLOTH.