UNC5174 Linux Espionage Campaign (Campaign)

UNC5174, a suspected Chinese state-sponsored threat actor, has conducted a stealthy Linux-focused espionage campaign since at least November 2024 using a custom dropper called SNOWLIGHT to load an in-memory fileless RAT named VShell (executed via memfd_create and fexecve) and deploying Sliver implants as fallback persistence; the actors employ phishing, domain impersonation, and encrypted WebSocket C2 over HTTPS (plus mTLS/WireGuard for Sliver) to evade detection and maintain persistent access across research, government, NGO, and critical infrastructure targets.