Unc5221

UNC5221, a threat actor linked to China, has been identified as the group behind recent cyberattacks involving new malware specifically designed to exploit vulnerabilities in Ivanti Connect Secure VPN and Policy Secure devices. The discovery was made by Mandiant researchers who observed the deployment of a new web shell, tracked as ROOTROT, during their investigation of an Ivanti Connect Secure appliance compromised by UNC5221. The threat actor accessed the vCenter appliance using SSH and downloaded the BRICKSTORM backdoor, creating a stealthy and persistent backdoor on the infected device. In January 2024, the MITRE Corporation reported a breach of its systems, attributing the attack to UNC5221. The attack involved the chaining of two zero-day vulnerabilities in Ivanti's Connect Secure software. Indicators of compromise observed during this security breach overlapped with those associated with UNC5221, further solidifying the link between this threat actor and the attacks. Despite initial mitigation efforts, these actions were deemed insufficient in retrospect. The activities of UNC5221 represent a significant cybersecurity concern due to their advanced persistent threat (APT) nature, sophisticated techniques, and the group's apparent focus on exploiting specific network security products. In one instance, the deployment of ROOTROT led to UNC5221 initiating network reconnaissance and lateral movement to a VMware vCenter server. Furthermore, during an analysis of a compromise by UNC5221, Mandiant identified four distinct components of the custom malware toolset SPAWN being used in concert to establish a robust backdoor on an infected appliance.