Security Resilience

Threat actor · all actors

UTA0178MISP-f288f686 state

🇨🇳 CN

aka UTA0178, UNC5221, Red Dev 61

Last updated: 2026-10-16

5attributed CVEs
0ATT&CK techniques
15.0IDF score (tooling uniqueness)
0exclusive CVEs
2024years active

About this actor

While Volexity largely observed the attacker essentially living off the land, they still deployed a handful of malware files and tools during the course of the incident which primarily consisted of webshells, proxy utilities, and file modifications to allow credential harvesting. Once UTA0178 had access into the network via the ICS VPN appliance, their general approach was to pivot from system to system using compromised credentials. They would then further compromise credentials of users on any new system that was breached, and use these credentials to log into additional systems via RDP. Volexity observed the attacker obtaining credentials in a variety of ways.

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MandiantUNC uncategorised cluster

UNC5221

Unclassifiedno scheme matched

UTA0178Red Dev 61

How we know this

Data origin
MISP threat-actor galaxy Imported from the open-source MISP threat-actor galaxy.
Techniques
No ATT&CK techniques mapped.
Named victims
None on file.

Thin data: No ATT&CK techniques are mapped yet — the behavioural profile is empty.

See how actor data is built for the full pipeline.

Activity timeline

2024: 5 CVE published2024: 3 KEV added82024
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2024-21888 9.18.80.86812024-01-31see CVE
CVE-2024-21887 KEV9.09.11.00002024-01-12see CVE
CVE-2023-46805 KEV8.98.20.99992024-01-12see CVE
CVE-2024-21893 KEV8.98.21.00002024-01-31see CVE
CVE-2024-22024 8.68.30.94722024-02-13see CVE

No techniques attributed.

Co-occurring actors

Similar actors

Overlapping CVEs

Active in same years

Same nation-state

Same category