Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · UNC5337 · Unknown · assessed origin China · misp-galaxy · refreshed 2026-10-06

UNC5337

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. 2026-10-18todaynew CVE2 new CVEs: CVE-2023-46805, CVE-2024-21887

Analyst brief

misp-galaxy

UNC5337 is a suspected China-nexus espionage actor that compromised Ivanti Connect Secure VPN appliances as early as Jan. 2024. UNC5337 is suspected to exploit CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection) for infecting Ivanti Connect Secure appliances.

UNC5337 leveraged multiple custom malware families including the SPAWNSNAIL passive backdoor, SPAWNMOLE tunneler, SPAWNANT installer, and SPAWNSLOTH log tampering utility. Mandiant suspects with medium confidence that UNC5337 is UNC5221.

CVEs UNC5337 is cited as exploiting

2 on CISA KEV
  1. CVE-2023-46805KEV2026-10-17
    1. “UNC5337 is suspected to exploit CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection) for infecting Ivanti Connect Secure appliances.”

      cited as exploiting · source: cloud.google.com ↗ · 2026-10-17

  2. CVE-2024-21887KEV2026-10-17
    1. “UNC5337 is suspected to exploit CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection) for infecting Ivanti Connect Secure appliances.”

      cited as exploiting · source: cloud.google.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Detections

6 rules · Sigma · QRadar · Cortex

  1. CVE exploitation

    CVE-2023-46805 exploitation attempt

    CVE-2023-46805 · GhostEmperor · UNC5337 · UTA0178 · WARP PANDA

    T1190conf 90SIGAQLXQL

  2. CVE exploitation

    CVE-2024-21887 exploitation attempt

    CVE-2024-21887 · UNC5325 · UNC5330 · UNC5337 · UTA0178 · WARP PANDA

    T1190conf 90SIGAQLXQL

Generated by skopnix from this finding, each with false-positive notes. Open the list →

Take it with you

keyless · no signup

References

1 source
  1. 1.cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitati…

Track UNC5337 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.