216.73.217.22

UNC5337

· Published 21/12/2025 08:44 · Modified 21/12/2025 08:44 · Source: AlienVault

Essential information

Confidence
100/100
Published
21/12/2025 08:44
Modified
21/12/2025 08:44
Updated at
21/12/2025 08:44
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
2 reports, 16 attack patterns (mitre), 6 malware, 17 indicators, 4 vulnerabilities (cve)

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (2)

Attack patterns (MITRE) (16)

  • T1190 uses
    Exploit Public-Facing Application
  • T1078 uses
    Valid Accounts
  • T1053.005 uses
    Scheduled Task
  • T1021.001 uses
    Remote Desktop Protocol
  • T1055.012 uses
    Process Hollowing
  • T1543.003 uses
    Windows Service
  • T1059 uses
    Command and Scripting Interpreter
  • T1571 uses
    Non-Standard Port
  • T1557 uses
    Adversary-in-the-Middle
  • T1003 uses
    OS Credential Dumping
  • T1562.004 uses
    Disable or Modify System Firewall
  • T1213 uses
    Data from Information Repositories
  • T1133 uses
    External Remote Services
  • T1070.004 uses
    File Deletion
  • T1105 uses
    Ingress Tool Transfer
  • T1505.003 uses
    Web Shell

Malware (6)

  • SPAWNSLOTH uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 21/12/2025 08:44 · Modified 21/12/2025 08:44
  • PHASEJAM uses
    Family
    Published 09/01/2025 08:56 · Modified 09/01/2025 08:56
  • DRYHOOK uses
    Family
    Published 09/01/2025 08:56 · Modified 09/01/2025 08:56
  • SPAWNANT uses
    Family
    Published 09/01/2025 08:56 · Modified 09/01/2025 08:56
  • SPAWNMOLE uses
    Family
    Published 17/01/2025 17:17 · Modified 17/01/2025 17:17
  • SPAWNSNAIL uses
    Family
    Published 17/01/2025 17:17 · Modified 17/01/2025 17:17

Indicators (17)

Vulnerabilities (CVE) (4)

CVE-2025-0283
7.0 High

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA …

Attack vector
LOCAL
Published
09/01/2025
Modified
21/12/2025
Analyzed
CVE-2025-0282 KEV
9.0 Critical

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA …

Attack vector
Network
Published
08/01/2025
Modified
21/12/2025
Analyzed
CVE-2024-21887 KEV
9.1 Critical

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web …

Attack vector
Network
Published
10/01/2024
Modified
27/05/2026
CVE-2023-46805 KEV
8.2 High

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the …

Attack vector
Network
Published
10/01/2024
Modified
27/05/2026