Driven Response to UNC5174
summary
Claims UNC5174 combines custom dropper SNOWLIGHT with open-source backdoors like VShell and SLIVER and achieves stealth by fileless Go malware that fetches payloads at runtime and upgrades to websocket C2. Campaign sustains hundreds of IPs and domains—hundreds of domains—and uses phishing .bar archives for initial access. Defenders observe large memory reservations, persistence via cron/systemd, and that detection succeeds when using behavior rules (example: Falco rules) rather than static IOCs.
AI-written summary · about
chapters (10)
- 0:00UNC5174 introduction
- 2:59Discovery and targets
- 5:29Initial access and delivery
- 9:01Persistence and evasion
- 12:58Infrastructure and resources
- 16:34Vshell malware analysis
- 21:51MITRE ATT&CK recap
- 25:30Attribution challenges
- 33:02Defensive strategies
- 40:31Key takeaways
related talks
47mDetecting and analyzing files-less malware
57mHiding In Plain Sight - Advances In Malware Covert Communication Channels
39mREDIScovering HeadCrab - A Technical Analysis of a Novel Malware and the Mind Behind It
39mReal-World Detection Evasion Techniques in the Cloud
29mThe Wolf in Sheep's Clothing: How Cybercriminals Leverage OneNote for Stealthy...
52mFlying Under the Radar - New Security Evasion Techniques
46mAttacks, Lies and the Underground World
43m"A rootkits writer’s guide to defense"