🇨🇳

BRONZE SPRING

APT Group Information theft and espionage 4 zero-day CVEs ETDA ✓

Also Known As 1 names

UNC302

Target Countries 25

Countries highlighted in red

Australia Belgium Canada China Germany Spain United Kingdom Hong Kong Israel India Islamic Republic of Iran Japan Republic of Korea Lithuania Montenegro Mongolia Malaysia Netherlands Philippines Sweden Thailand Turkey Province of China Taiwan United States Vietnam

Sectors Targeted

Public Administration 92 Pharmaceuticals Research and Development in the Social Sciences and Humanities 54172 Religious, Grantmaking, Civic, Professional, and Similar Organizations 813 Defense industrial base Chemical Manufacturing 325 Civil engineering Space Research and Technology 927 Professional, Scientific, and Technical Services 54 Information technology Computer Systems Design and Related Services 54151 Gaming Computer Systems Design and Related Services 5415 Computer Systems Design Services 541512 Business Energy Telecommunications 517 Educational Services 61 Air Transportation 481 Information 51 Medical Education

Details

Origin 🇨🇳 CN

Last Updated 23 Jul 2022

MITRE ATT&CK 11

T1036 - Masquerading T1055 - Process Injection T1057 - Process Discovery T1059 - Command and Scripting Interpreter T1071.001 T1078.003 T1134 - Access Token Manipulation T1190 - Exploit Public-Facing Application T1505 - Server Software Component T1530 - Data from Cloud Storage Object T1566

Related Zero-Days 4

CVE-2024-12356 CVE-2025-14847 CVE-2025-55182 CVE-2025-59287

Known Names 2 entries

UNC5221 Mandiant

UTA0178 Volexity

Observed Target Countries 1

Based on ETDA data — countries highlighted in red

Worlwide

Description

(Mandiant) Note: This is a developing campaign under active analysis by Mandiant and Ivanti. We will continue to add more indicators, detections, and information to this blog post as needed. On January 10, 2024, Ivanti disclosed two vulnerabilities, CVE-2023-46805 and CVE-2024-21887, impacting Ivanti Connect Secure VPN (“CS”, formerly Pulse Secure) and Ivanti Policy Secure (“PS”) appliances. Successful exploitation could result in authentication bypass and command injection, leading to further downstream compromise of a victim network. Mandiant has identified zero-day exploitation of these vulnerabilities in the wild beginning as early as December 2023 by a suspected espionage threat actor, currently being tracked as UNC5221.

Tools Used 8

BRICKSTORM GLASSTOKEN LIGHTWIRE PySoxy THINSPOOL WARPWIRE WIREFIRE ZIPLINE

Operations 2

2022 NVISO analyzes BRICKSTORM espionage backdoor https://blog.nviso.eu/wp-content/uploads/2025/04/NVISO-BRICKSTORM-Report.pdf

2025-03 Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457) https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-exploiting-critical-ivanti-vulnerability

Reports & References 3

https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/ https://www.volexity.com/blog/2024/01/15/ivanti-connect-secure-vpn-exploitation-goes-global/

ETDA Profile

UNC5221, UTA0178

Origin

China

First Seen 2022

Motivation

Information theft and espionage

View on ETDA APT Groups ↗