ChinaAssessedSuspected MSS contractorEspionageActive 2023 – 2025UNC5174
Also known asBRONZE SNOWDROP
Summary
China-nexus initial-access actor that Mandiant believes uses the persona "Uteus": a former member of Chinese hacktivist collectives that has since shown indications of acting as a contractor for China's Ministry of State Security, focused on access operations. It exploits internet-facing edge and enterprise software quickly after disclosure (T1190) — F5 BIG-IP (CVE-2023-46747), ConnectWise ScreenConnect (CVE-2024-1709), Atlassian Confluence, Zyxel and, in 2025, SAP NetWeaver — then creates administrator accounts on the appliance (T1136.001) and, on F5, tried to patch the flaw behind it. It runs bash commands (T1059.004) that pull its SNOWLIGHT downloader (T1105), which loads payloads such as GOHEAVY, GOREVERSE or, from 2025, the VShell RAT straight into memory through memfd (T1620), with WebSocket C2 (T1071.001). Mandiant saw it try to sell access to US defence-contractor appliances, UK government entities and Asian institutions in late 2023; Sysdig and SentinelLABS suspect it hands access to other actors. SentinelLABS loosely associates a September 2024 intrusion into a European media organisation with it. Sliver and Metasploit, which Sophos also lists, are public tools and not recorded here.
Attribution
Mandiant: indications of MSS contract work; Sophos CTU: likely state-tasked; no government attribution
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- Mandiant (Research, 2024-03-21)
Former hacktivist, now showing indications of acting as an MSS contractor - Sophos CTU (Research, 2026-10)
Operating from China, likely accepting tasking from the state
Campaigns 5
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| SAP NetWeaver Visual Composer exploitation delivering SNOWLIGHT and VShellASSESSED | 2025-04 | Undisclosed | Critical Infrastructure | EclecticIQ (2025) — UNC5174 "very likely" behind a webshell deployed on 28 April 2025 |
| SNOWLIGHT downloader delivering the fileless VShell RAT | 2025-01 – 2025-04 | Undisclosed | Undisclosed | Sysdig (2025-04-15) — first seen late January 2025; end is the publication month; victims not named |
| European media organisation intrusion via Ivanti CSA (SentinelLABS Activity F)ASSESSED | 2024-09 | Europe | Media | SentinelLABS (2025) — attributed to a China-nexus actor with high confidence and only loosely associated with UNC5174 |
| ConnectWise ScreenConnect exploitation of hundreds of institutions | 2024-02 | USA, Canada | Undisclosed | Mandiant (2024-03-21) |
| F5 BIG-IP exploitation and access sales — US defence contractors, UK government, Asian institutions | 2023-10 – 2023-11 | USA, UK, Southeast Asia, Hong Kong | Defense, Government, Research, Academia, NGOs | Mandiant (2024-03-21) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 6
| Initial Access1 | T1190Exploit Public-Facing Application |
|---|---|
| Execution1 | T1059.004Unix Shell |
| Persistence1 | T1136.001Local Account |
| Stealth1 | T1620Reflective Code Loading |
| Command and Control2 | T1105Ingress Tool TransferT1071.001Web Protocols |
Malware and tools 5
| Name | Description | Platform |
|---|---|---|
| SNOWLIGHT | Downloader (C) | Linux |
| GOHEAVY | Payload (Go) | Linux |
| GOREVERSE | Reverse SSH backdoor (Go, public) | Linux |
| SUPERSHELL | C2 framework (public) | Linux |
| VShell | C2 framework (Go) | windows/linux |
Exploited vulnerabilities 8
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2023-22518 | 10 | Atlassian Confluence — improper authorization (KEV 2023-11-07) |
| CVE-2024-1709 | 10 | ConnectWise ScreenConnect — authentication bypass (KEV 2024-02-22) |
| CVE-2025-31324 | 10 | SAP NetWeaver Visual Composer — unrestricted file upload (KEV 2025-04-29) |
| CVE-2022-30525 | 9.8 | Zyxel Firewall OS Command Injection (KEV 2022-05-16) |
| CVE-2023-46747 | 9.8 | F5 BIG-IP Configuration Utility — authentication bypass (KEV 2023-10-31) |
| CVE-2024-8963 | 9.4 | Ivanti Cloud Services Appliance — path traversal (KEV 2024-09-19) |
| CVE-2022-0185 | 8.4 | Linux kernel — heap-based buffer overflow (KEV 2024-08-21) |
| CVE-2024-8190 | 7.2 | Ivanti Cloud Services Appliance — OS command injection (KEV 2024-09-13) |
Highest CVSS first.
Infrastructure patterns
- SNOWLIGHT reaches a hard-coded C2 IP over raw sockets on TCP 443 (Mandiant, 2024)
- VShell C2 over WebSockets; domain squatting of well-known brands (Sysdig, 2025)
Reporting and advisories 5
- Mandiant
Bringing access back — initial access brokers exploit F5 BIG-IP and ScreenConnect (Mar 2024) - Sysdig
UNC5174's evolution: from SNOWLIGHT to VShell (Apr 2025) - EclecticIQ
China-nexus actors exploit SAP NetWeaver CVE-2025-31324 (2025) - SentinelLABS
Follow the smoke — PurpleHaze and ShadowPad clusters (2025) - Sophos CTU
BRONZE SNOWDROP threat profile