UNC5221

Overview 78 indicators

No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.

Principal sources 21 reports

Ranked by how many of this actor's indicators each report brought in.

• 20mandiant.com/resources/blog/suspected-apt-targets-iv…
• 20github.com/Gi7w0rm/MalwareConfigLists/blob/main/Iv…
• 20virustotal.com/gui/file/bebf615de9018e36e2acca7dfa3ff1…
• 16volexity.com/blog/2024/01/10/active-exploitation-of-…
• 16mandiant.com/resources/blog/suspected-apt-targets-iv…
• 15x.com/blackorbird/status/2062934926392275391
• 15volexity.com/blog/2026/06/04/verdantbamboo-just-anot…
• 15github.com/volexity/threat-intel/blob/main/2026/20…

Timeline 78 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2026-06-05 15 domainthis year

   x.com/blackorbird/status/2062934926392275391 · volexity.com/blog/2026/06/04/verdantbamboo-just-anot… · github.com/volexity/threat-intel/blob/main/2026/20…

   172-235-56-113.plesk.page

   azdatastore.workers.dev

   barannclinic.com

   bititer.org

   calixcloudinfo.com

   devs.calixcloudinfo.com

   faoith.com

   fiveworkscorp.com

   kitfloor.org

   msazure.azdatastore.workers.dev

   natsupport.net

   performanceviewtools.com

   service.systemsvcs.com

   systemsvcs.com

   winfoacacorp.com

   copy batch

2. 2026-01-02 or earlier 7 domainthis year

   x.com/WhichbufferArda/status/1925210805793955… · blog.eclecticiq.com/china-nexus-threat-actor-actively-explo…

   abbeglasses.s3.amazonaws.com

   fconnect.s3.amazonaws.com

   openrbf.s3.amazonaws.com

   the-mentor.s3.amazonaws.com

   tkshopqd.s3.amazonaws.com

   tnegadge.s3.amazonaws.com

   trkbucket.s3.amazonaws.com

   copy batch

3. 2024-09-05 1 url, 1 url_path2 yrs ago

   cloud.google.com/blog/topics/threat-intelligence/investi… · github.com/HarfangLab/iocs/blob/main/iv_lastauthse…

   url	nssa.gov.mm/temp/get.php
   url_path	/lastauthserverused.js

   copy batch

4. 2024-06-15 4 domain2 yrs ago

   volexity.com/blog/2024/01/18/ivanti-connect-secure-v… · otx.alienvault.com/pulse/65aa779d249935925e76fe93 · github.com/volexity/threat-intel/blob/main/2024/20…

   abode-dashboard-media.s3.ap-south-1.amazonaws.com

   archivevalley-media.s3.amazonaws.com

   blooming.s3.amazonaws.com

   shapefiles.fews.net.s3.amazonaws.com

   copy batch

5. 2024-02-03 1 domain2 yrs ago

   mandiant.com/resources/blog/investigating-ivanti-zer…

   clicko.click

   copy batch

6. 2024-01-24 1 ipv4, 6 url_path2 yrs ago

   github.com/SEKOIA-IO/Community/blob/main/IOCs/CVE-… · virustotal.com/gui/file/1662268ef5e797a480c963d8899d70… · virustotal.com/gui/file/6a24558987bbdb6dafc81948abeb91…

   ipv4	81.2.216.78:29742
   url_path	/T7cNxSSK4d/
   url_path	/T7cNxSSK4d/lib
   url_path	/T7cNxSSK4d/upd.sh
   url_path	/dG7n47d7Gz/
   url_path	/dG7n47d7Gz/lib
   url_path	/dG7n47d7Gz/upd.sh

   copy batch

7. 2024-01-22 5 domain, 4 ipv4, 11 url2 yrs ago

   mandiant.com/resources/blog/suspected-apt-targets-iv… · github.com/Gi7w0rm/MalwareConfigLists/blob/main/Iv… · virustotal.com/gui/file/bebf615de9018e36e2acca7dfa3ff1…

   domain	api.d-n-s.name
   domain	catcher.requestcatcher.com
   domain	duorhytm.fun
   domain	safe.rocks
   domain	secure-cama.com
   ipv4	146.0.228.66:1080
   ipv4	146.0.228.66:8111
   ipv4	66.42.68.120:443
   ipv4	8.137.112.245:8001
   url	areekaweb.com/js/chat.php
   url	cpanel.netbar.org/assets/js/xml.php
   url	dcgems.net/plugins/authentication/auth.php
   url	ehangmun.com/board/selectbox/xml.php
   url	entraide-internationale.fr/IMG/xml.php
   url	http://152.32.128.64
   url	http://159.65.130.146
   url	http://35.201.216.249
   url	http://89.23.107.155
   url	http://91.92.254.14
   url	miltonhouse.nl/assets/js/xml.php

   copy batch

8. 2024-01-22 2 domain, 1 ipv4, 1 url2 yrs ago

   twitter.com/JusticeRage/status/1749466349309501570

   domain	clickcom.click
   domain	line-api.com
   ipv4	45.227.255.213:30303
   url	http://154.223.17.218

   copy batch

9. 2024-01-22 2 domain2 yrs ago

   twitter.com/felixaime/status/1749454051601776979

   psecure.pro

   telemetry.psecure.pro

   copy batch

10. 2024-01-12 3 domain, 13 url2 yrs ago

    volexity.com/blog/2024/01/10/active-exploitation-of-… · mandiant.com/resources/blog/suspected-apt-targets-iv…

    domain	gpoaccess.com
    domain	symantke.com
    domain	webb-institute.com
    url	http://173.220.106.166
    url	http://173.53.43.7
    url	http://206.189.208.156
    url	http://47.207.9.89
    url	http://50.213.208.89
    url	http://50.215.39.49
    url	http://50.243.177.161
    url	http://64.24.179.210
    url	http://71.127.149.194
    url	http://73.128.178.221
    url	http://75.145.224.109
    url	http://75.145.243.85
    url	http://98.160.48.170

    copy batch

Further reading 21

• virustotal.com/gui/file/1662268ef5e797a480c963d8899d70…
• github.com/volexity/threat-intel/blob/main/2026/20…
• virustotal.com/gui/file/bebf615de9018e36e2acca7dfa3ff1…
• twitter.com/JusticeRage/status/1749466349309501570
• blog.eclecticiq.com/china-nexus-threat-actor-actively-explo…
• volexity.com/blog/2024/01/10/active-exploitation-of-…
• mandiant.com/resources/blog/suspected-apt-targets-iv…
• github.com/HarfangLab/iocs/blob/main/iv_lastauthse…
• mandiant.com/resources/blog/suspected-apt-targets-iv…
• x.com/WhichbufferArda/status/1925210805793955…
• github.com/SEKOIA-IO/Community/blob/main/IOCs/CVE-…
• otx.alienvault.com/pulse/65aa779d249935925e76fe93
• volexity.com/blog/2024/01/18/ivanti-connect-secure-v…
• github.com/volexity/threat-intel/blob/main/2024/20…
• twitter.com/felixaime/status/1749454051601776979
• x.com/blackorbird/status/2062934926392275391
• mandiant.com/resources/blog/investigating-ivanti-zer…
• virustotal.com/gui/file/6a24558987bbdb6dafc81948abeb91…
• github.com/Gi7w0rm/MalwareConfigLists/blob/main/Iv…
• volexity.com/blog/2026/06/04/verdantbamboo-just-anot…
• cloud.google.com/blog/topics/threat-intelligence/investi…