Disassembling the SNOWLIGHT Linux Loader

~Sekoia~
Technical analysis of the SNOWLIGHT ELF downloader, used by UNC5174, reveals methods to extract its C2 configuration.
-
IOCs: SNOWLIGHT, UNC5174, /tmp/log_de. log
-
#Linux #SNOWLIGHT #ThreatIntel #UNC5174

📰 CISA Perintahkan Lembaga Federal AS Segera Tambal Celah VMware Tools yang Dieksploitasi Peretas China

👉 Baca artikel lengkap di sini: ahmandonk.com/2025/11/01/cisa-orders-f...

#bod-22-01 #broadcom #china #cisa #cybersecurity #unc5174 #vmware

APT cinesi sfruttano vulnerabilità zero-day in VMware e Windows per spionaggio su sistemi e diplomatici europei, con alert CISA e malware PlugX.

#apt #cina #cisa #MustangPanda #PlugX #unc5174 #vmware #Windows #zeroday
www.matricedigitale.it/2025/10/31/a...

China-linked hackers exploit VMware zero-day vulnerability since Oct 2024. Organizations urged to patch immediately. #CyberSecurity #VMware #ZeroDay #UNC5174 Link: thedailytechfeed.com/china-linked...

“Google Mandiant security analysts, who believe UNC5174 is a contractor for China's Ministry of State Security (MSS), have observed the threat actor selling access to networks of U.S. defense contractors …”

🚨
#UNC5174
#ChineseMalware
#ChineseHackers

UNC5174 sfrutta zero-day Ivanti per colpire enti francesi; obiettivo: accessi iniziali da rivendere a terzi.

#cina #csa #Francia #houken #Ivanti #rootkit #sysinitd #unc5174 #vulnerabilità #zeroday
www.matricedigitale.it/2025/07/03/u...

UNC5174 utilizza malware fileless come vshell e snowlight con c2 websocket e tecniche evasive per spionaggio e persistenza su Linux

#CobaltStrike #cyberspionaggio #filelessmalware #gooogleasia #guerracibernetica #Linux #snowlight #unc5174 #vshell #WebSocket
www.matricedigitale.it/sicurezza-in...

Chinese espionage group leans on open-source tools to mask intrusions Sysdig researchers say UNC5174’s use of open-source tools like VShell and WebSockets has likely helped the group mask its presence in other campaigns.

Chinese espionage group leans on open-source tools to mask intrusions Sysdig researchers say UNC5...

cyberscoop.com/chinese-espionage-group-...

#Cybercrime #ANSSI #China #Remote #access #trojan #sysdig #UNC5174

Event Attributes

Chinese espionage group leans on open-source tools to mask intrusions Sysdig researchers say UNC5174’s use of open-source tools like VShell and WebSockets has likely helped the group mask its presence in other campaigns.

Chinese espionage group leans on open-source tools to mask intrusions Sysdig researchers say UNC5...

cyberscoop.com/chinese-espionage-group-...

#Cybercrime #China #Remote #access #trojan #sysdig #ANSSI #UNC5174

Event Attributes