Threat actor
ARMORY CASTLE
Also known as Magnet Goblin, Red Dev 61, UNC5221, UTA0178, WARP PANDA
ARMORY CASTLE (formerly tracked as UNC5221) is a highly sophisticated, suspected China-nexus cyber-espionage threat group known for targeting enterprise edge infrastructure and virtualized network appliances. The group specializes in zero-day exploitation and "Living-off-the-Land" (LoTL) techniques to bypass traditional security visibility. By deploying advanced, self-healing backdoors (like BRICKSTORM) on infrastructure lacking endpoint detection and response (EDR) agents, they maintain long-term, undetected persistence to steal sensitive intellectual property, source code, and strategic data. Their primary targets include global government, defense, energy, and technology manufacturing organizations. Would you like more details on their specific malware tools (such as BRICKSTORM or SAWFLY), or do you need a list of remediation strategies for their recent appliance exploits?
Get the data
This profile is a free sample. Download the STIX 2.1 bundle, which imports directly into OpenCTI, MISP and other STIX platforms.