SYMBOLCOMMON_NAMEaka. SYNONYMS

UNC5174  (Back to overview)

aka: Uteus

UNC5174, a Chinese state-sponsored threat actor, has been identified by Mandiant for exploiting critical vulnerabilities in F5 BIG-IP and ScreenConnect. They have been linked to targeting research and education institutions, businesses, charities, NGOs, and government organizations in Southeast Asia, the U.S., and the UK. UNC5174 is believed to have connections to China's Ministry of State Security and has been observed using custom tooling and the SUPERSHELL framework in their operations. The actor has shown indications of transitioning from hacktivist collectives to working as a contractor for Chinese intelligence agencies.

Associated Families
elf.goreverse elf.snowlight
References
2026-05-05 ⋅ Cisco Talos ⋅ Asheer Malhotra, Brandon White, Jungsoo An
UAT-8302 and its box full of malware
SNOWLIGHT DracuLoader FINALDRAFT SNAPPYBEE STOWAWAY VShell UAT-8302
2025-12-19 ⋅ PolySwarm Tech Team ⋅ PolySwarm
Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell)
ANGRYREBEL COMPOOD MINOCAT Mirai SNOWLIGHT XMRIG EtherRAT Cobalt Strike Mirai VShell xmrig JACKPOT PANDA
2025-12-12 ⋅ Google ⋅ Aragorn Tseng, Austin Larsen, CASEY CHARRIER, Genevieve Stark, Robert Weiner, Zander Work
Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)
ANGRYREBEL COMPOOD MINOCAT SNOWLIGHT Earth Lamia JACKPOT PANDA
2025-08-20 ⋅ Ctrl-Alt-Intel ⋅ Ctrl-Alt-Intel
From Campus to C2: Tracking a Persistent Chinese Operation Against Vietnamese Universities
GOREVERSE SNOWLIGHT Cobalt Strike reGeorg VShell
2025-07-01 ⋅ ANSSI ⋅ ANSSI
Houken: Seeking a Path by Living on The Edge With Zero-Days
GOREVERSE
2025-05-13 ⋅ EclecticIQ ⋅ Arda Büyükkaya
China-Nexus Nation State Actors Exploit SAP NetWeaver (CVE-2025-31324) to Target Critical Infrastructures
KrustyLoader SNOWLIGHT VShell CL-STA-0048
2025-04-15 ⋅ sysdig ⋅ Alessandra Rizzo
UNC5174’s evolution in China’s ongoing cyber warfare: From SNOWLIGHT to VShell
SNOWLIGHT Sliver VShell
2024-03-22 ⋅ RH-ISAC ⋅ Lee Clark
Chinese Threat Group UNC5174 Reportedly Exploiting F5 BIG-IP and ScreenConnect CVEs for Active Exploitation
GOREVERSE SNOWLIGHT Sliver UNC5174
2024-03-21 ⋅ Mandiant ⋅ Adam Aprahamian, Austin Larsen, Dan Kelly, Marcin Siedlarz, Mathew Potaczek, Michael Raggi
Bringing Access Back — Initial Access Brokers Exploit F5 BIG-IP (CVE-2023-46747) and ScreenConnect
GOREVERSE SNOWLIGHT Sliver UNC5174
2024-03-21 ⋅ Mandiant ⋅ Adam Aprahamian, Austin Larsen, Dan Kelly, Marcin Siedlarz, Mathew Potaczek, Michael Raggi
Bringing Access Back — Initial Access Brokers Exploit F5 BIG-IP (CVE-2023-46747) and ScreenConnect
GOREVERSE SNOWLIGHT
Credits: MISP Project