UNC5221

Reported Context (5)

GTI tracks the threat cluster associated with KrustyLoader activity; CIS reports vendor attribution links but says it cannot independently confirm the actor behind this campaign. CIS Analyzes KrustyLoader’s Use of S3 Buckets to Deliver Sliver
China-nexus actor linked to BRICKSTORM operations targeting government and IT-sector environments. EclecticIQ Report Warns of Escalating Cyber Risks Amid Regional Conflicts
Listed by the article as another tracking name associated with VerdantBamboo, also identified as WARP PANDA. Volexity Details VerdantBamboo Breach Using BRICKSTORM on Edge Appliances
The report assesses that the PhiliKit implant is part of this group's SPAWN toolset targeting Ivanti VPN appliances. ESET Report Details APT Campaigns and Threat Trends From October 2025 to March 2026
Name under which the article says QuietCrabs is also known. QuietCrabs and Thor Exploited RCE Flaws in Campaigns Against Russian Companies

CVE (10)

Malware (18)

People (5)

Threat Actors (40)

MITRE ATT&CK (37)

Vendors (22)

Products (26)

Tools (16)

Industries (25)

Countries (30)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.