APT Explorer

All actors

UTA0178

Also reported as UNC5221 and Red Dev 61. Linked to China by three sources.

Reports
33
Last reported
Known CVEs
98
Origin
China
ID
uta0178
Sources
MISPETDAMalpedia
Merge evidence
5 alias matches

Reports per quarter

Dated reports, 2024 Q1 to 2026 Q2.

Techniques seen in the last two years

Show all 263 techniques Show fewer

Counts come from technique IDs in the actor's report text.

CVEs named in reports

Show all 98 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. eset-apt-activity-report-q4-2025-q1-2026.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  2. BRICKSTORM Malware: UNC5221 Targets Tech and Legal Sectors in the United States

    date ORKL added it ORKL

    Archived copy on ORKL Details

  3. Resecurity | F5 BIG-IP Source Code Leak Tied to State-Linked Campaigns Using BRICKSTORM Backdoor

    date ORKL added it ORKL

    Archived copy on ORKL Details

  4. Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation

    date ORKL added it ORKL

    Archived copy on ORKL Details

  5. UNC5221’s Latest Exploit: Weaponizing CVE-2025-22457 in Ivanti Connect Secure

    date ORKL added it ORKL

    Archived copy on ORKL Details

  6. Ivanti Connect Secure VPN Exploitation: New Observations

    date ORKL added it ORKL

    Archived copy on ORKL Details

  7. Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation

    date ORKL added it ORKL

    Archived copy on ORKL Details

  8. UNC5221: Unreported and Undetected WIREFIRE Web Shell Variant

    date ORKL added it ORKL

    Archived copy on ORKL Details

  9. Infiltrating Defenses: Abusing VMware in MITRE’s Cyber Intrusion

    date ORKL added it ORKL

    Archived copy on ORKL Details

  10. Ivanti Connect Secure VPN Exploitation Goes Global

    date ORKL added it ORKL

    Archived copy on ORKL Details

Show all 33 reports Show fewer

  1. Rewterz Threat Advisory - Ivanti VPN Zero-Days Weaponized by UNC5221 Threat Actors to Deploy Multiple Malware Families – Active IOCs - Rewterz

    date ORKL added it ORKL

    Archived copy on ORKL Details

  2. 2026_YIR_ExecutiveBriefing%20O_G.pdf?hsLang=en

    file creation date ORKL

    Archived copy on ORKL Details

  3. UNC6201 Exploiting a Dell RecoverPoint for Virtual Machines Zero-Day

    Malpedia library date ORKL

    Archived copy on ORKL Details

  4. Threats to the Defense Industrial Base

    Malpedia library date ORKL

    Archived copy on ORKL Details

  5. BRICKSTORM Backdoor | CISA

    Malpedia library date ORKL

    Archived copy on ORKL Details

  6. Unveiling WARP PANDA: A New Sophisticated China-Nexus Adversary

    Malpedia library date ORKL

    Archived copy on ORKL Details

  7. Dragons in Thunder

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  8. F5 BIG-IP Source Code Leaked in State-Linked Cyberattack (BRICKSTORM Malware) – Qualys ThreatPROTECT

    Malpedia library date ORKL

    Archived copy on ORKL Details

  9. Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors

    Malpedia library date ORKL

    Archived copy on ORKL Details

  10. China-Nexus Nation State Actors Exploit SAP NetWeaver (CVE-2025-31324) to Target Critical Infrastructures

    Malpedia library date ORKL

    Archived copy on ORKL Details

  11. m-trends-2025-en.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  12. NVISO-BRICKSTORM-Report.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  13. Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457)

    Malpedia library date ORKL

    Archived copy on ORKL Details

  14. MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur’s Multi-Platform Attacks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  15. Uncovering Akira's privilege escalation techniques

    Malpedia library date ORKL

    Archived copy on ORKL Details

  16. Technical Deep Dive: Understanding the Anatomy of a Cyber Intrusion

    Malpedia library date ORKL

    Archived copy on ORKL Details

  17. cyberespionage_report_2023.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  18. Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies

    Malpedia library date ORKL

    Archived copy on ORKL Details

  19. Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies

    Malpedia library date ORKL

    Archived copy on ORKL Details

  20. KrustyLoader - Rust malware linked to Ivanti ConnectSecure compromises

    Malpedia library date ORKL

    Archived copy on ORKL Details

  21. Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation

    Malpedia library date ORKL

    Archived copy on ORKL Details

  22. Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN _ Volexity

    file creation date ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  23. Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN

    Malpedia library date ORKL

    Archived copy on ORKL Details

Newest first. Details opens the report in Explore.