SYMBOL | COMMON_NAME | aka. SYNONYMS |
UNC4841 is a well-resourced threat actor that has utilized a wide range of malware and purpose-built tooling to enable their global espionage operations. They have been observed selectively deploying specific malware families at high priority targets, with SKIPJACK being the most widely deployed. UNC4841 primarily targeted government and technology organizations, but they have also been observed targeting other verticals.
There are currently no families associated with this actor.
2025-01-21
⋅
Trend Micro
⋅
Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions Cobalt Strike HemiGate ShadowPad SNAPPYBEE SparrowDoor UNC4841 |
2024-08-24
⋅
YouTube (Black Hat)
⋅
Chinese APT: A Master of Exploiting Edge Devices (Video) SEASPY UNC4841 |
2024-04-19
⋅
TEAMT5
⋅
Chinese APT: A Master of Exploiting Edge Devices SEASPY UNC4841 |
2023-12-24
⋅
Barracuda
⋅
Barracuda Email Security Gateway Appliance (ESG) Vulnerability UNC4841 |
2023-09-23
⋅
Mandiant
⋅
Special Delivery: Defending and Investigating Advanced Intrusions on Secure Email Gateways SALTWATER SEASPY WHIRLPOOL UNC4841 |
2023-09-05
⋅
CISA
⋅
MAR-10454006.r5.v1 SUBMARINE, SKIPJACK, SEASPRAY, WHIRLPOOL, and SALTWATER Backdoors SALTWATER WHIRLPOOL UNC4841 |
2023-08-29
⋅
Google
⋅
Diving Deep into UNC4841 Operations Following Barracuda ESG Zero-Day Remediation (CVE-2023-2868) GhostEmperor UNC4841 |
2023-08-23
⋅
Mandiant
⋅
Special Delivery! Defending and Investigating Advanced Intrusions on Secure Email Gateways SALTWATER SEASPY WHIRLPOOL UNC4841 |
2023-08-17
⋅
CISA
⋅
MAR-10459736.r1.v1 WHIRLPOOL Backdoor WHIRLPOOL UNC4841 |
2023-08-08
⋅
CISA
⋅
MAR-10454006.r4.v2 SEASPY and WHIRLPOOL Backdoors SEASPY WHIRLPOOL UNC4841 |
2023-07-27
⋅
CISA
⋅
MAR-10454006-r1.v2 SUBMARINE Backdoor UNC4841 |
2023-07-27
⋅
CISA
⋅
MAR-10454006-r2.v1 SEASPY Backdoor SEASPY UNC4841 |
2023-07-27
⋅
CISA
⋅
MAR-10454006-r3.v1 Exploit Payload Backdoor UNC4841 |
2023-06-30
⋅
Mandiant
⋅
Barracuda ESG: CVE-2023-2868 Hardening Recommendations UNC4841 |
2023-06-15
⋅
Google
⋅
Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868) Exploited Globally by Aggressive and Skilled Actor, Suspected Links to China SALTWATER SEASPY WHIRLPOOL UNC4841 |
2023-06-15
⋅
Mandiant
⋅
Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868) Exploited Globally by Aggressive and Skilled Actor, Suspected Links to China SALTWATER SEASPY UNC4841 |