UNC5820 IP indicators (historical, hunt only)
SIGlowconfidence 75/100generated 2026-10-19
4 IP indicators skopnix attributes to UNC5820, named in published reports without live feed evidence. Retro-hunt only.
- Linked actors
- UNC5820
- False positives
- HISTORICAL, HUNT ONLY: do not block on this. These indicators come from published reports and do not meet the bar of the live sweep. 4 indicators. Evidence: 4 listed only by scanner / honeypot feeds (not counted as evidence). No feed sighting date exists for any of them. Screened against reserved space, MISP warninglists (CDN / cloud / scanners / top sites), GreyNoise when enriched, and sinkhole address lists. Re-validate against last_seen before blocking: infrastructure is re-assigned.
Sigma rule
skopnix-sigma-actor-unc5820-ip-hist-a2f25fc8.ymldownload .yml ↓title: Skopnix - UNC5820 IP indicators (historical, hunt only)
id: f8a9d6df-a82a-5b91-99df-4f6d18d505e6
status: experimental
description: 4 IP indicators skopnix attributes to UNC5820, named in published reports without live feed evidence. Retro-hunt only.
references:
- https://skopnix.com/actors/unc5820
author: skopnix
date: '2026-10-19'
tags:
- attack.command-and-control
- attack.t1071
logsource:
category: firewall
detection:
selection:
dst_ip:
- 104.238.141.143
- 158.247.199.37
- 195.85.114.78
- 45.32.41.202
condition: selection
falsepositives:
- Legitimate services sharing the address; verify against skopnix confidence + last_seen
- 'Reused or re-registered infrastructure: these indicators are historical'
level: low
How to deploy on Sigma
- 1.Convert for your SIEM with sigma-cli / pySigma, e.g. sigma convert -t splunk -p sysmon rule.yml.
- 2.Run it as a hunt first: every rule ships as status experimental.
- 3.Promote to an alert once a week of results is clean on your data.
Check · The processing pipeline must map the logsource (firewall, dns, proxy, webserver, process_creation) to your field names.