UNC5266 is a threat actor. This group is tracked in the Strobes VI threat intelligence database.

What vulnerabilities does UNC5266 exploit?

Specific CVE exploitation data for UNC5266 is being tracked. Check the Strobes VI threat actor profile for updates.

UNC5266

Exploited CVEs

Overview

Mandiant created UNC5266 to track post-disclosure exploitation leading to deployment of Bishop Fox's SLIVER implant framework, a WARPWIRE variant, and a new malware family that Mandiant has named TERRIBLETEA. At this time, based on observed infrastructure usage similarities, Mandiant suspects with moderate confidence that UNC5266 overlaps in part with UNC3569, a China-nexus espionage actor that has been observed exploiting vulnerabilities in Aspera Faspex, Microsoft Exchange, and Oracle Web Applications Desktop Integrator, among others, to gain initial access to target environments.

Exploited Vulnerabilities

No exploited CVEs have been attributed to this threat actor yet.

Browse CVE Database