China-Backed Threat Actor 'UNC5174' Using Open Source Tools in Stealthy Attacks

Sysdig research details an active campaign by UNC5174 — a Chinese state-backed actor — deploying Snowlight and Silver malware alongside a fileless, open-source VShell backdoor using WebSocket-based C2 to stealthily target research institutions, government organizations, think tanks, technology firms, NGOs, and critical infrastructure; Sysdig published detection rules and IOCs to help defenders identify the activity.