UNC5174

Reports per quarter

Techniques seen in the last two years

• T1105 2 reports
• T1140 2 reports
• T1574.001 2 reports
• T1595.002 2 reports
• T1003.001 1 report
• T1003.002 1 report
• T1005 1 report
• T1008 1 report
• T1027 1 report
• T1027.007 1 report

Counts come from technique IDs in the actor's report text.

CVEs named in reports

• CVE-2021-26855 KEV ransomware
• CVE-2022-0185 KEV
• CVE-2022-30525 KEV
• CVE-2023-22518 KEV ransomware
• CVE-2023-46747 KEV ransomware
• CVE-2023-46805 KEV ransomware
• CVE-2024-1708 KEV ransomware
• CVE-2024-1709 KEV ransomware
• CVE-2024-21887 KEV ransomware
• CVE-2024-3400 KEV ransomware
• CVE-2024-36401 KEV
• CVE-2024-8190 KEV

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 5 May 2026

   UAT-8302 and its box full of malware

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor UAT-8302 and its box full of malware

2. 19 December 2025

   Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell)

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell)

3. 12 December 2025

   Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)

4. 5 November 2025

   VShell

   Malpedia library date Maxime Thiebaut fromORKL

   Archived copy on ORKL Detailsfor VShell

5. 7 July 2025

   ANSSI Exposes "Houken": China-Linked APT Exploiting Ivanti CSA Zero-Days & Deploying Linux Rootkits

   Malpedia library date fromORKL

   The original link failed its last check. Original publisher Detailsfor ANSSI Exposes "Houken": China-Linked APT Exploiting Ivanti CSA Zero-Days & Deploying Linux Rootkits

6. 1 July 2025

   CERTFR-2025-CTI-009.pdf

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor CERTFR-2025-CTI-009.pdf

7. 9 June 2025

   Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets

8. 6 June 2025

   Operation DRAGONCLONE: Chinese Telecommunication industry targeted via VELETRIX & VShell malware

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Operation DRAGONCLONE: Chinese Telecommunication industry targeted via VELETRIX & VShell malware

9. 27 May 2025

   Earth Lamia Develops Custom Arsenal to Target Multiple Industries

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Earth Lamia Develops Custom Arsenal to Target Multiple Industries

10. 13 May 2025

    China-Nexus Nation State Actors Exploit SAP NetWeaver (CVE-2025-31324) to Target Critical Infrastructures

    Malpedia library date fromORKL

    Archived copy on ORKL Detailsfor China-Nexus Nation State Actors Exploit SAP NetWeaver (CVE-2025-31324) to Target Critical Infrastructures

Newest first. Details opens the report in Explore.