Cutting EdgeC0029 state

About this actor

[Cutting Edge](https://attack.mitre.org/campaigns/C0029) was a campaign conducted by suspected China-nexus espionage actors, variously identified as UNC5221/UTA0178 and UNC5325, that began as early as December 2023 with the exploitation of zero-day vulnerabilities in Ivanti Connect Secure (previously Pulse Secure) VPN appliances. [Cutting Edge](https://attack.mitre.org/campaigns/C0029) targeted the U.S. defense industrial base and multiple sectors globally including telecommunications, financial, aerospace, and technology. [Cutting Edge](https://attack.mitre.org/campaigns/C0029) featured the use of defense evasion and living-off-the-land (LoTL) techniques along with the deployment of web shells and other custom malware.(Citation: Mandiant Cutting Edge January 2024)(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)(Citation: Volexity Ivanti Global Exploitation January 2024)(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Mandiant Cutting Edge Part 3 February 2024)

Source: MITRE ATT&CK

How we know this

See how actor data is built for the full pipeline.

Activity timeline

• 2024 — 5 CVE published, 3 KEV added

Profile

Mitigating controls (NIST 800-53)

Co-occurring actors

• UTA0178 5 shared CVEs
• AnonOps 5 shared CVEs
• COMP-INTEL-MICRON 5 shared CVEs
• COMP-NOKIA-HUAWEI-2007 2 shared CVEs
• COMP-MICROSOFT-SALESFORCE 2 shared CVEs
• COMP-GOOGLE-CIVIL-DEFENDANT 2 shared CVEs
• COMP-AMAZON-WALMART-LOGISTICS 2 shared CVEs
• COMP-CROWDSTRIKE-MCAFEE 2 shared CVEs
• Salt Typhoon 2 shared CVEs
• Darkhotel 1 shared CVEs

Similar actors