Skip to content
brandefense.io
Request A Demo
UnclassifiedUnknown

UNC5337

UNC5337 is a threat actor group, tracked by Brandefense.

Request IOC feedRequest ATT&CK export
Techniques
0
Exploited CVEs
No CVE data
Record updated

About UNC5337.

UNC5337 is a suspected China-nexus espionage actor that compromised Ivanti Connect Secure VPN appliances as early as Jan. 2024. UNC5337 is suspected to exploit CVE- (authentication bypass) and CVE- (command injection) for infecting Ivanti Connect Secure appliances. UNC5337 leveraged multiple custom malware families including the SPAWNSNAIL passive backdoor, SPAWNMOLE tunneler, SPAWNANT installer, and SPAWNSLOTH log tampering utility.

Last updated Sep 12, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.