UNC5174 (Uteus) is a Chinese state-linked cyber espionage group known for exploiting F5 BIG-IP and ScreenConnect vulnerabilities.
Analyst brief
UNC5174 (also tracked as Uteus) is a Chinese state-sponsored cyber espionage group identified by Mandiant for exploiting critical vulnerabilities in F5 BIG-IP and ScreenConnect. They primarily target research and education institutions, businesses, charities, NGOs, and government organizations across Southeast Asia, the U.S., and the UK. The actor employs custom tooling and the SUPERSHELL framework in their operations, showing signs of transitioning from hacktivist collectives to contractor roles for Chinese intelligence agencies. Defenders should prioritize patching F5 BIG-IP and ScreenConnect vulnerabilities and monitor for indications of SUPERSHELL activity, such as anomalous shell traffic patterns.
UNC5174
Uteus
unknown
UNC5174, a Chinese state-sponsored threat actor, has been identified by Mandiant for exploiting critical vulnerabilities in F5 BIG-IP and ScreenConnect. They have been linked to targeting research and education institutions, businesses, charities, NGOs, and government organizations in Southeast Asia, the U.S., and the UK. UNC5174 is believed to have connections to China's Ministry of State Security and has been observed using custom tooling and the SUPERSHELL framework in their operations. The actor has shown indications of transitioning from hacktivist collectives to working as a contractor for Chinese intelligence agencies.