File · UNC5174 · Unknown · misp-galaxy · refreshed 2026-10-06
UNC5174
- Uteus
sigil · no ATT&CK coverage stated
What changed
ledger · newest first- —todaynew CVE2 new CVEs: CVE-2023-46747, CVE-2024-1709
Analyst brief
misp-galaxyUNC5174, a Chinese state-sponsored threat actor, has been identified by Mandiant for exploiting critical vulnerabilities in F5 BIG-IP and ScreenConnect. They have been linked to targeting research and education institutions, businesses, charities, NGOs, and government organizations in Southeast Asia, the U.S., and the UK. UNC5174 is believed to have connections to China's Ministry of State Security and has been observed using custom tooling and the SUPERSHELL framework in their operations. The actor has shown indications of transitioning from hacktivist collectives to working as a contractor for Chinese intelligence agencies.
CVEs reports attribute to UNC5174
none on KEV- CVE-2024-17092026-10-17
“Mandiant previously linked UNC5174 to the exploitation of F5 BIG-IP (CVE-2023-46747) and ConnectWise ScreenConnect (CVE-2024-1709).”
attributed by a report · source: blog.eclecticiq.com ↗ · 2026-10-17
- CVE-2023-467472026-10-17
“Mandiant previously linked UNC5174 to the exploitation of F5 BIG-IP (CVE-2023-46747) and ConnectWise ScreenConnect (CVE-2024-1709).”
attributed by a report · source: blog.eclecticiq.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Take it with you
keyless · no signupReferences
2 sourcesTrack UNC5174 on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.