UNC5221
UNC5221 is a China-attributed nation-state APT group with an ideological motive, tracked by Brandefense. It targets 4 sectors, including Government and Technology, in 9 countries, including the United States and India. It uses 29 MITRE ATT&CK techniques and exploits 4 known CVEs.
Also known as
- UTA0178
- Origin
- China
- Techniques
- 29
- Exploited CVEs
- 4
- First seen
- Apr 4, 2025
- Last seen
- Dec 5, 2025
- Record updated
Who They Target.
Labelsbdef-qf:latestespionageglobal
About UNC5221.
Activity cluster linked by Google Threat Intelligence Group to suspected Chinese hackers, known for exploiting Ivanti zero-days to target government agencies with custom Spawnant and Zipline malware.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.