UNC5174’s evolution in China’s ongoing cyber warfare: From SNOWLIGHT to VShell

Sysdig’s report details an active UNC5174 (Chinese state-affiliated) campaign that uses the SNOWLIGHT dropper to deliver a fileless VShell RAT (executed via memfd/fexecve) and Sliver implants to Linux hosts, leveraging WebSocket-based C2 on impersonated domains (e.g., gooogleasia.com, sex666vr.com). The analysis includes decompiled code, behavioral artifacts, IOCs (domains, IPs, SHA256s), and detection guidance (Falco rules and a YARA rule) to identify the fileless payload, memory allocation patterns, and network indicators.