UNC4540 is a Chinese-linked cyber espionage group targeting SonicWall appliances with a TinyShell backdoor.
Analyst brief
UNC4540 is a suspected Chinese threat actor active since 2021, focusing on cyber espionage. The group primarily targets unpatched SonicWall Secure Mobile Access appliances. Their key TTPs involve deploying a TinyShell backdoor variant designed to steal hashed credentials, provide shell access, and persist through firmware upgrades. Defenders should prioritize timely patching of perimeter network devices, and monitor for anomalous authentication attempts and unexpected firmware modifications.
UNC4540
unknown
UNC4540 is a suspected Chinese threat actor targeting unpatched SonicWall Secure Mobile Access appliances to deploy custom malware that establishes long-term persistence for cyber espionage. The malware is designed to steal hashed credentials, provide shell access, and persist through firmware upgrades, utilizing a variant of the TinyShell backdoor. Mandiant has tracked UNC4540's activities back to 2021, noting their focus on maintaining access to compromised devices. The group's tactics are consistent with patterns observed in other Chinese threat actor campaigns targeting network devices for zero-day exploits.