UNC5337

Executive Summary

UNC5337 is a suspected China-nexus espionage actor that has compromised Ivanti Connect Secure VPN appliances since January 2024. The group is associated with medium-confidence links to UNC5221 and has demonstrated the ability to exploit specific vulnerabilities (CVE-2023-46805 and CVE-2024-21887) using a suite of custom malware tools, including SPAWNSNAIL, SPAWNMOLE, SPAWNANT, and SPAWNSLOTH. This actor's targeting of critical infrastructure suggests a focus on espionage or intelligence gathering.

Goals & Targeting

UNC5337's primary objective appears to be espionage, targeting sectors that rely on secure network communication systems, such as government agencies, critical infrastructure providers, and private enterprises. The actor’s focus on compromising VPN appliances suggests an interest in gaining unauthorized access to sensitive networks and intercepting communications. Their targeting of specific CVEs indicates a preference for vulnerabilities that allow persistence and privilege escalation, aligning with the goals of a nation-state threat group aiming to maintain long-term access to strategic systems.

UNC5337 is a cyber threat actor suspected to have ties to China-based operations, primarily focusing on espionage activities. The group has targeted Ivanti Connect Secure VPN appliances as early as January 2024, compromising these systems through the exploitation of known vulnerabilities: CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection). These exploits have allowed UNC5337 to deploy a range of custom malware tools, including: 1. **SPAWNNSNAIL**: A passive backdoor for long-term access. 2. **SPAWNMOLE**: A tunnelling tool likely used for establishing command and control (C2) communications. 3. **SPAWNANT**: An installer that facilitates the deployment of additional malicious payloads. 4. **SPWNSLOTH**: A utility used for log tampering, likely to erase evidence of compromise or disrupt system integrity. The actor's suspected link to UNC5221, identified with medium confidence by Mandiant, suggests a potential connection to other state-sponsored activities. While the exact operational temerity and full range of targets are unclear, UNC5337's focus on critical infrastructure such as VPN appliances indicates a strategic intent to disrupt or gather sensitive information.

Key Capabilities

• Exploitation of specificCVEs (e.g., CVE-2023-46805, CVE-2024-21887)
• Deployment of custom malware families
• Backdoor creation and persistence mechanisms
• Command and control (C2) communication via tunnelling tools
• Log tampering to obscure malicious activity

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

UNC5337 has demonstrated a campaign pattern focused on compromising secure communication systems, with activity first observed in January 2024. The actor's operational tempo suggests a methodical approach, leveraging custom tools to establish persistence and exfiltrate data. While specific campaigns remain unclear, the targeting of critical infrastructure aligns with state-sponsored espionage tactics. Notable past operations include the exploitation of Ivanti Connect Secure appliances.

IOC Patterns

• Spear-phishing with targeted exploits
• Use of CVE-2023-46805 and CVE-2024-21887
• Deployment of custom malware families like SPAWNSNAIL and SPAWNMOLE
• Signatures related to VPN appliance compromise
• Log tampering on compromised systems

Recommended Actions

• Patch all systems against known CVEs (e.g., CVE-2023-46805, CVE-2024-21887)
• Monitor for unusual activity in VPN appliances and network logs
• Implement multi-factor authentication to mitigate authentication bypass risks
• Conduct regular security audits of third-party software
• Use endpoint detection and response (EDR) solutions to identify custom malware activity

Suggested Tags