Threat Intelligence / Actor / UNC5337 / CL-UNK-0979 (China-nexus suspected)

UNC5337 / CL-UNK-0979 (China-nexus suspected)

Nation: China · 1 tracked threat(s) · Categories: MALWARE

Also known as: UNC5337, CL-UNK-0979, SPAWN family operators

Tracked threats

RESURGE Passive Rootkit — Ivanti Connect Secure CVE-2025-0282 Exploitation, CRC32 TLS Fingerprint C2, Covert SSH Channel, SPAWNCHIMERA/SPAWNSLOTH Variants, CISA MAR Update — CRITICAL

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence