UNC5291

Reports per quarter

CVEs named in reports

• CVE-2019-11539 KEV ransomware
• CVE-2020-8218 KEV
• CVE-2023-46805 KEV ransomware
• CVE-2024-21887 KEV ransomware
• CVE-2024-21893 KEV ransomware

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 6 April 2026

   Beijing accused of misusing Western research to claim Volt Typhoon is a ransomware group

   date ORKL added it fromORKL

   Archived copy on ORKL Detailsfor Beijing accused of misusing Western research to claim Volt Typhoon is a ransomware group

2. 4 April 2024

   Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies

3. 4 April 2024

   Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies

Newest first. Details opens the report in Explore.