UNC5221 is a China-nexus cyber-espionage cluster tracked by Mandiant/Google, observed since at least 2023 and best known for mass exploitation of Ivanti Connect Secure VPN zero-days disclosed in January 2024. It operates on internet-facing edge and virtualization appliances — devices that cannot run EDR — and maintains long-dwell access for strategic intelligence collection. It has no MITRE group ID (it is a Mandiant “UNC” cluster). Public reporting sometimes links it to APT27/Silk Typhoon, but Google’s threat group explicitly treats UNC5221 and Silk Typhoon as distinct, with only tactical overlap.
Attribution
China-nexus espionage, assessed by Mandiant with high confidence; links to APT27/Silk Typhoon are disputed and lower confidence. A related cluster, UNC5337, is assessed by Mandiant with moderate confidence to be part of UNC5221. Overlaps with Volexity’s UTA0178 designation for the initial Ivanti intrusions.
Targeting
Internet-facing edge, VPN and virtualization appliances across technology/SaaS, legal services, business-process outsourcers, government, defence and telecom, in many countries. The focus is strategic espionage, including downstream supply-chain positioning.
Notable Campaigns
- January 2024: mass exploitation of Ivanti Connect Secure VPN zero-days (commonly cited as CVE-2023-46805 auth bypass and CVE-2024-21887 command injection).
- December 2024–January 2025: further Ivanti Connect Secure zero-day exploitation (commonly cited as CVE-2025-0282), attributed to the related UNC5337/UNC5221.
- April 2025: additional Ivanti exploitation (commonly cited as CVE-2025-22457).
- 2024–2025 (BRICKSTORM): an espionage campaign against U.S. technology, legal and SaaS firms; Mandiant reported an average dwell time of roughly 393 days.
Malware & Tooling
The SPAWN ecosystem on Ivanti appliances — SPAWNANT (installer), SPAWNMOLE (tunneler), SPAWNSNAIL (SSH backdoor), SPAWNSLOTH (log tampering) and later SPAWNWAVE — and BRICKSTORM, a Go-based multi-platform backdoor (web server, file manipulation, dropper and SOCKS relay) deployed on appliances and VMware vCenter/ESXi hosts, with some use of DNS-over-HTTPS for C2. DRYHOOK (credential theft) and PHASEJAM (web-shell dropper) appeared in Ivanti intrusions but were not attributed by Mandiant to a known actor.
MITRE ATT&CK Mapping
No official ATT&CK group ID — a Mandiant cluster; techniques below are mapped from reported behaviour.
| Tactic | Technique | Usage |
|---|---|---|
| Initial Access | T1190 Exploit Public-Facing App | Ivanti VPN zero-days |
| Persistence | T1505.003 Web Shell | PHASEJAM; upgrade-surviving installers |
| Defense Evasion | T1070 Indicator Removal | SPAWNSLOTH log tampering |
| Command and Control | T1071.004 DNS | BRICKSTORM DNS-over-HTTPS |
| Exfiltration | T1041 Exfiltration Over C2 | Credential/email/data theft |
Detection & Mitigation
- Patch Ivanti Connect Secure/Policy Secure promptly and run Ivanti’s Integrity Checker Tool; treat compromised appliances as fully untrusted (rebuild, rotate all secrets and certificates), since persistence can survive factory reset and upgrade.
- Hunt on appliances and ESXi/vCenter (no-EDR surfaces); use Mandiant’s BRICKSTORM scanner (which may miss variants) and monitor for DNS-over-HTTPS to anomalous destinations and unexpected SOCKS tunneling.
- Watch for VM cloning or export activity on vCenter and for new web shells on edge devices.
Secure Edge and Virtualization Appliances
Mjolnir Security helps organisations harden and monitor the no-EDR surfaces attackers favour.
- Attack Surface Management Finding and patching exposed VPN, firewall and virtualization appliances.
- Compromise Assessment Hunting for SPAWN/BRICKSTORM on appliances and vCenter/ESXi.
- 24/7 Incident Response Containment when edge-device compromise is suspected. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts