China’s new cyber arsenal revealed. [Research Saturday]

CyberWire Daily

N2K Networks, Inc.

Daily News, Tech News, News, Technology

4.6 • 1K Ratings

🗓️ 26 April 2025

⏱️ 22 minutes

🔗️ Recording | iTunes | RSS

🧾️ Download transcript

Summary

Today we are joined by Crystal Morin, Cybersecurity Strategist from Sysdig, as she is sharing their work on "UNC5174’s evolution in China’s ongoing cyber warfare: From SNOWLIGHT to VShell." UNC5174, a Chinese state-sponsored threat actor, has resurfaced with a stealthy cyber campaign using a new arsenal of customized and open-source tools, including a variant of their SNOWLIGHT malware and the VShell RAT. Sysdig researchers discovered that the group targets Linux systems through malicious bash scripts, domain squatting, and in-memory payloads, indicating a high level of sophistication and espionage intent. Their evolving tactics, such as using spoofed domains and fileless malware, continue to blur attribution and pose a significant threat to research institutions, critical infrastructure, and NGOs across the West and Asia-Pacific regions. The research can be found here: UNC5174’s evolution in China’s ongoing cyber warfare: From SNOWLIGHT to VShell Learn more about your ad choices. Visit megaphone.fm/adchoices

Transcript

Click on a timestamp to play from that location

0:00.0	You're listening to the Cyberwire Network, powered by N2K.
0:09.7	And now a message from Black Cloak.
0:14.8	Did you know the easiest way for cyber criminals to bypass your company's defenses
0:19.0	is by targeting your executives and their families
0:22.2	at home. Black Cloaks award-winning digital executive protection platform secures their personal
0:28.5	devices, home networks, and connected lives. Because when executives are compromised at home,
0:34.6	your company is at risk. In fact, over one-third of new members discover they've already been breached.
0:41.4	Protect your executives and their families 24-7-365 with Black Cloak. Learn more at blackcloak.io. Hello everyone and welcome to the CyberWires Research Saturday.
1:03.3	I'm Dave Bittner, and this is our weekly conversation with researchers and analysts
1:07.8	tracking down the threats and vulnerabilities, solving some of the hard
1:11.8	problems and protecting ourselves in a rapidly evolving cyberspace.
1:16.7	Thanks for joining us.
1:21.6	This threat actor was identified by Google's Mandian threat group about a year ago.
1:30.5	The interesting thing about this threat actor is they are not the typical Chinese nation state
1:39.4	APT like you expect. They're not a government-sponsored entity.
1:46.3	We believe from the way that this actor is behaving, and from what Mandian has said in their
1:53.8	previous reporting, that this is an individual or possibly multiple, but as of right now, it's a person who is contracted by the
2:05.5	Chinese government to support their cyber war efforts.
2:11.1	That's Crystal Morin, cybersecurity strategist from Sistig.
2:15.2	The research we're discussing today is titled UNC-574's Evolution in China's Ongoing Cyberwarfare,
2:23.1	from Snowlight to V-Shell.
2:32.2	So it's not someone who works for the government. He's just his own independent person.
	...

Transcript will be available on the free plan in 24 days. Upgrade to see the full transcript now.

Previous episode | Next episode

Disclaimer: The podcast and artwork embedded on this page are from N2K Networks, Inc., and are the property of its owner and not affiliated with or endorsed by Tapesearch.

Generated transcripts are the property of N2K Networks, Inc. and are distributed freely under the Fair Use doctrine. Transcripts generated by Tapesearch are not guaranteed to be accurate.