SYMBOLCOMMON_NAMEaka. SYNONYMS

UNC4841  (Back to overview)

aka: SLIME57

UNC4841 is a well-resourced threat actor that has utilized a wide range of malware and purpose-built tooling to enable their global espionage operations. They have been observed selectively deploying specific malware families at high priority targets, with SKIPJACK being the most widely deployed. UNC4841 primarily targeted government and technology organizations, but they have also been observed targeting other verticals.


Associated Families

There are currently no families associated with this actor.


References
2025-01-21Trend MicroLeon Chang, Theo Chen
Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions
Cobalt Strike HemiGate ShadowPad SNAPPYBEE SparrowDoor UNC4841
2024-08-24YouTube (Black Hat)Charles Li, Che Chang, Greg Chen
Chinese APT: A Master of Exploiting Edge Devices (Video)
SEASPY UNC4841
2024-04-19TEAMT5Charles Li, Che Chang, Greg Chen
Chinese APT: A Master of Exploiting Edge Devices
SEASPY UNC4841
2023-12-24BarracudaBarracuda
Barracuda Email Security Gateway Appliance (ESG) Vulnerability
UNC4841
2023-09-23MandiantFernando Tomlinson, Nader Zaveri
Special Delivery: Defending and Investigating Advanced Intrusions on Secure Email Gateways
SALTWATER SEASPY WHIRLPOOL UNC4841
2023-09-05CISACISA
MAR-10454006.r5.v1 SUBMARINE, SKIPJACK, SEASPRAY, WHIRLPOOL, and SALTWATER Backdoors
SALTWATER WHIRLPOOL UNC4841
2023-08-29GoogleAustin Larsen, John Palmisano, John Wolfram, Mathew Potaczek, Michael Raggi
Diving Deep into UNC4841 Operations Following Barracuda ESG Zero-Day Remediation (CVE-2023-2868)
GhostEmperor UNC4841
2023-08-23MandiantFernando Tomlinson, Nader Zaveri
Special Delivery! Defending and Investigating Advanced Intrusions on Secure Email Gateways
SALTWATER SEASPY WHIRLPOOL UNC4841
2023-08-17CISACISA
MAR-10459736.r1.v1 WHIRLPOOL Backdoor
WHIRLPOOL UNC4841
2023-08-08CISACISA
MAR-10454006.r4.v2 SEASPY and WHIRLPOOL Backdoors
SEASPY WHIRLPOOL UNC4841
2023-07-27CISACISA
MAR-10454006-r1.v2 SUBMARINE Backdoor
UNC4841
2023-07-27CISACISA
MAR-10454006-r2.v1 SEASPY Backdoor
SEASPY UNC4841
2023-07-27CISACISA
MAR-10454006-r3.v1 Exploit Payload Backdoor
UNC4841
2023-06-30MandiantMandiant
Barracuda ESG: CVE-2023-2868 Hardening Recommendations
UNC4841
2023-06-15GoogleAlyssa Glickman, Austin Larsen, Fernando Tomlinson, Jakub Jozwiak, John Palmisano, John Wolfram, Josh Villanueva, Mathew Potaczek, Matthew McWhirt
Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868) Exploited Globally by Aggressive and Skilled Actor, Suspected Links to China
SALTWATER SEASPY WHIRLPOOL UNC4841
2023-06-15MandiantAustin Larsen, John Palmisano, John Wolfram, Mathew Potaczek, Matthew McWhirt
Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868) Exploited Globally by Aggressive and Skilled Actor, Suspected Links to China
SALTWATER SEASPY UNC4841

Credits: MISP Project