Watch Floor
State-backedChina

UTA0178

Also known as UNC5221, Red Dev 61, ARMORY CASTLE

1mentions, 7 days
6mentions, 30 days
Nov 2, 2026last mentioned

While Volexity largely observed the attacker essentially living off the land, they still deployed a handful of malware files and tools during the course of the incident which primarily consisted of webshells, proxy utilities, and file modifications to allow credential harvesting. Once UTA0178 had access into the network via the ICS VPN appliance, their general approach was to pivot from system to system using compromised credentials. They would then further compromise credentials of users on any new system that was breached, and use these credentials to log into additional systems via RDP. Volexity observed the attacker obtaining credentials in a variety of ways.

Targets: Germany

CVEs in recent coverage

Recent victims

No leak-site posts on record for this group.

Recent activity

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.