The China-linked risk actor often called UNC5174 has been attributed to a brand new marketing campaign that leverages a variant of a recognized malware dubbed SNOWLIGHT and a brand new open-source software known as VShell to contaminate Linux methods.
“Menace actors are more and more utilizing open supply instruments of their arsenals for cost-effectiveness and obfuscation to economize and, on this case, plausibly mix in with the pool of non-state-sponsored and infrequently much less technical adversaries (e.g., script kiddies), thereby making attribution much more tough,” Sysdig researcher Alessandra Rizzo stated in a report shared with The Hacker Information.
“This appears to carry very true for this explicit risk actor, who has been below the radar for the final yr since being affiliated with the Chinese language authorities.”
UNC5174, additionally known as Uteus (or Uetus), was beforehand documented by Google-owned Mandiant as exploiting safety flaws in Connectwise ScreenConnect and F5 BIG-IP software program to ship a C-based ELF downloader named SNOWLIGHT, which is designed to fetch a Golang tunneler dubbed GOHEAVY from infrastructure tied to a publicly obtainable command-and-control (C2) framework often called SUPERSHELL.
Additionally deployed within the assaults was GOREVERSE, a publicly obtainable reverse shell backdoor written in Golang that operates over Safe Shell (SSH).
The French Nationwide Company for the Safety of Data Techniques (ANSSI), in its Cyber Menace Overview report for 2024 revealed final month, stated it noticed an attacker using comparable tradecraft as that of UNC5174 to weaponize safety flaws in Ivanti Cloud Service Equipment (CSA) comparable to CVE-2024-8963, CVE-2024-9380, and CVE-2024-8190 to realize management and execute arbitrary code.
“Reasonably refined and discreet, this intrusion set is characterised by way of intrusion instruments largely obtainable as open supply and by the – already publicly reported – use of a rootkit code,” the ANSSI stated.
It is value noting that each SNOWLIGHT and VShell are able to focusing on Apple macOS methods, with the latter distributed as a faux Cloudflare authenticator software as a part of an as-yet-undetermined assault chain, in accordance with an evaluation of artifacts uploaded to VirusTotal from China in October 2024.
Within the assault chain noticed by Sysdig in late January 2025, the SNOWLIGHT malware acts as a dropper for a fileless, in-memory payload known as VShell, a distant entry trojan (RAT) broadly utilized by Chinese language-speaking cybercriminals. The preliminary entry vector used for the assault is presently unknown.
Particularly, the preliminary entry is used to execute a malicious bash script (“download_backd.sh”) that deploys two binaries related to SNOWLIGHT (dnsloger) and Sliver (system_worker), each of that are used to arrange persistence and set up communications with a C2 server.
The ultimate stage of the assault delivers VShell through SNOWLIGHT by the use of a specifically crafted request to the C2 server, thereby enabling distant management and additional post-compromise exploitation.
“[VShell] acts as a RAT (Distant Entry Trojan), permitting its abusers to execute arbitrary instructions and obtain or add information,” Rizzo stated. “SNOWLIGHT and VShell pose a big danger to organizations attributable to their stealthy and complex strategies,” Sysdig stated. “That is evidenced by the employment of WebSockets for command-and-control, in addition to the fileless VShell payload.”
The disclosure comes as TeamT5 revealed {that a} China-nexus hacking group seemingly exploited safety flaws in Ivanti home equipment (CVE-2025-0282 and CVE-2025-22457) to realize preliminary entry and deploy the SPAWNCHIMERA malware.
The assaults, the Taiwanese cybersecurity firm stated, focused a large number of sectors spanning practically 20 completely different international locations comparable to Austria, Australia, France, Spain, Japan, South Korea, Netherlands, Singapore, Taiwan, the United Arab Emirates, the UK, and america.
The findings additionally dovetail with accusations from China that the U.S. Nationwide Safety Company (NSA) launched “superior” cyber assaults through the Asian Winter Video games in February, pointing fingers at three NSA brokers for repeated assaults on China’s vital info infrastructure in addition to towards Huawei.
“On the ninth Asian Winter Video games, the U.S. authorities performed cyberattacks on the knowledge methods of the Video games and the vital info infrastructure in Heilongjiang,” International Ministry Spokesperson Lin Jian stated. “This transfer is egregious for it severely endangers the safety of China’s vital info infrastructure, nationwide protection, finance, society, and manufacturing in addition to its residents’ private info.”
