UNC5221

Summary

Suspected China-nexus espionage cluster that Mandiant/Google Threat Intelligence Group (GTIG) tracked as UNC5221 and, since Oct 2026, as ARMORY CASTLE; it specialises in zero-day exploitation of edge appliances. Mandiant observed it exploiting Ivanti Connect Secure CVE-2023-46805 and CVE-2024-21887 from as early as December 2023, CVE-2025-0282 from mid-December 2024 and CVE-2025-22457 from mid-March 2025, and GTIG also attributes zero-day exploitation of Citrix NetScaler CVE-2023-4966 to it. On Ivanti appliances it trojanises legitimate components and deploys the SPAWN malware ecosystem, web shells (LIGHTWIRE, WIREFIRE) and the WARPWIRE credential harvester, and routes operations through an obfuscation network of compromised Cyberoam, QNAP and ASUS devices. GTIG attributes BRICKSTORM intrusions against US legal, SaaS, BPO and technology organisations, with an average dwell time of 393 days and a focus on VMware vCenter/ESXi, to UNC5221 and closely related clusters. GTIG notes that UNC5221 has been used synonymously with Silk Typhoon in public reporting but does not consider the two clusters to be the same. Volexity (Jun 2026) equates UNC5221 with its VerdantBamboo and CrowdStrike's WARP PANDA, whose 2025 vCenter/ESXi intrusions added the Junction and GuestConduit implants. DOJ's Mar 2025 i-SOON release lists 'UNC 5221' and 'Silk Typhoon' among APT27's names; Mandiant/GTIG and Microsoft track all three separately, so ThreatNexus records that equation as disputed and does not merge the records. In Oct 2026 GTIG attributed zero-day exploitation of BeyondTrust Remote Support CVE-2026-102764 from late Aug 2026 to ARMORY CASTLE: the actor dropped the SAWFLY PHP web shell, gained root through a SUID shell copy and a boot-time sudoers-template change, dumped the appliance credential vault, raised a compromised account to Administrator over Jump Items, tunnelled through the BARECLAW SOCKS5-over-WebSocket tool behind a modified HAProxy route, and repeatedly deleted logs.

Attribution

GTIG does not equate it with Silk Typhoon

Hedged, circumstantial or press-only reporting; not established.

• Google Threat Intelligence Group / Mandiant (Research, 2025-09-24)
  Suspected China-nexus espionage cluster

MITRE ATT&CK techniques 15

Exploited vulnerabilities 7

Highest CVSS first.

Infrastructure patterns

• HAProxy config edited to expose the BARECLAW tunneler (127.0.0.1:19800) to the internet (GTIG, 2026)

Reporting and advisories 8

• Mandiant/GTIG
  Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors
• Mandiant/GTIG
  Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457)
• Mandiant
  Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation (CVE-2025-0282)
• Mandiant
  Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation
• Volexity
  VerdantBamboo — 18-month persistence through an MSP and EDR-blind edge appliances (BRICKSTORM, PLENET)
• CrowdStrike
  WARP PANDA — VMware vCenter / ESXi intrusions (BRICKSTORM, Junction, GuestConduit)
• ESET APT Activity Report Q4 2025–Q1 2026
  PhiliKit passive backdoor on Ivanti VPN appliances (SPAWN toolset)
• CrowdStrike Counter Adversary Operations
  CrowdStrike 2026 Legal Threat Landscape Report (Oct 2026)