UnclassifiedIdeologyAdvanced sophistication
UTA0533
UTA0533 is a threat actor group with an ideological motive, tracked by Brandefense. It uses 5 MITRE ATT&CK techniques.
- Techniques
- 5
- Exploited CVEs
- No CVE data
- Record updated
About UTA0533.
UTA0533 has been linked to compromised SonicWall SMA appliances, with exploitation beginning on June 22, 2026. The actor routed traffic through ExpressVPN and Mullvad exit nodes, utilizing over 200 IP addresses. Notably, several attacker hostnames, including a Kali Linux machine, were leaked during lateral movement, indicating hands-on-keyboard intrusion.
Last updated Sep 12, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.