Chinese snoops use F5, ConnectWise bugs to sell access into top US, UK networks

Mandiant attributes large-scale exploitation of multiple high-severity vulnerabilities (including CVE-2023-46747 in F5 BIG-IP and CVE-2024-1709 in ConnectWise ScreenConnect) to UNC5174, a China-linked initial-access broker that used a SUPERSHELL C2 and payloads such as SNOWLIGHT, GOHEAVY and GOREVERSE to gain persistent access and sell entry to high-value organizations (US defense, UK government, universities and others); Mandiant assesses with moderate confidence the group may be operating as an MSS contractor and warns defenders to review provided IOCs and hardening guidance.