Actors
Threat-actor profiles, focused on groups exploiting Linux, ESXi and edge devices. Infrastructure is re-checked every day from hunting queries; samples marked free can be downloaded as STIX 2.1 bundles.
-
ARMORY CASTLE free
ARMORY CASTLE (formerly tracked as UNC5221) is a highly sophisticated, suspected China-nexus cyber-espionage threat group known for targeting enterprise edge infrastructure and virtualized network appliances. The group specializes in zero-day exploitation and "Living-off-the-Land" (LoTL) techniques to bypass traditional security visibility. By deploying advanced, self-healing backdoors (like BRICKSTORM) on infrastructure lacking endpoint detection and response (EDR) agents, they maintain long-term, undetected persistence to steal sensitive intellectual property, source code, and strategic data. Their primary targets include global government, defense, energy, and technology manufacturing organizations. Would you like more details on their specific malware tools (such as BRICKSTORM or SAWFLY), or do you need a list of remediation strategies for their recent appliance exploits?