Full Report
Sysdig researchers say UNC5174’s use of open-source tools like VShell and WebSockets has likely helped the group mask its presence in other campaigns. The post Chinese espionage group leans on open-source tools to mask intrusions appeared first on CyberScoop.
Analysis Summary
# Threat Actor: UNC5174
## Attribution & Identity
State-sponsored hacking group believed to have ties to the Chinese government.
Known Aliases: UNC5174.
## Activity Summary
UNC5174 has recently been observed blending in with common cybercriminal activity by leveraging open-source tools. A new campaign involved using VShell (an open-source RAT popular among Chinese cybercriminals) for post-exploitation. The group targets Western governments, technology companies, research institutions, and think tanks. In 2024, they were observed exploiting vulnerabilities in Ivanti’s Cloud Service Appliance product (CVE-2024-8190) to gain remote code execution. There is a hypothesis that this intrusion set may be functioning as an initial access broker, selling access to other operators. Specific campaigns have been active since at least November 2024.
## Tactics, Techniques & Procedures
- Use of VShell (an open-source Remote Access Trojan) for post-exploitation activity.
- Communication with C2 infrastructure via WebSockets to mask malicious traffic through encrypted transmissions.
- Reliance on custom malware for post-exploitation targeting Linux-based systems.
- Use of SNOWLIGHT malware family, including the payload "dnsloger," which works alongside VShell to deploy fileless malware.
- Demonstrated in-depth knowledge of Linux operating systems for persistence, defensive evasion, and injection techniques.
- Exploitation of vulnerabilities such as **CVE-2024-8190** (in Ivanti’s Cloud Service Appliance) to gain RCE.
- Potential use of typosquatted website domains and phishing tactics for initial access.
- Use of previously reported rootkit code.
## Targeting
- Sectors: Western governments, technology companies, research institutions, and think tanks.
- Geography: Not explicitly stated, but likely Western-aligned countries given target types.
- Victims: Not named specifically, but organizations utilizing Ivanti Cloud Service Appliance were victims of known exploitation.
## Tools & Infrastructure
- Malware Families: VShell (RAT), SNOWLIGHT (including "dnsloger" payload).
- Infrastructure: Command-and-control domains suggesting the use of typosquatted website domains for staging or phishing.
- URLs/IPs (Defanged):
- C2 domains suggested typosquatting techniques.
## Implications
UNC5174 is adapting its tradecraft by shifting from entirely bespoke tooling (a characteristic of advanced state-sponsored actors) to using publicly available or commodity tools like VShell and WebSockets. This adoption of "script-kiddie" level tooling allows the group to effectively mask their sophisticated activities, making detection more challenging by blending in with lower-tier criminal traffic. Their potential role as an initial access broker suggests they are a commercially motivated as well as espionage-minded entity.
## Mitigations
- Monitor for the deployment and execution of VShell, particularly following exploitation of critical systems.
- Implement security measures to detect and prevent fileless malware deployment associated with the SNOWLIGHT family.
- Harden Linux-based systems against common persistence, evasion, and injection techniques utilized by sophisticated actors.
- Implement robust phishing and domain monitoring to detect typosquatting attempts for initial access.
- Ensure timely patching of products like Ivanti appliances against publicly exploited vulnerabilities (e.g., CVE-2024-8190).