Threat Actor 🇨🇳 China

UNC4841

Also known as: SLIME57

UNC4841 is a well-resourced threat actor that has utilized a wide range of malware and purpose-built tooling to enable their global espionage operations. They have been observed selectively deploying specific malware families at high priority targets, with SKIPJACK being the most widely deployed. UNC4841 primarily targeted government and technology organizations, but they have also been observed targeting other verticals.

Source Articles

Barracuda warns of critical flaws allowing root access to devices

Barracuda Networks disclosed two critical vulnerabilities in its Email Security Gateway (ESG) and other products that could allow attackers with access to administrative interfaces to bypass authorization controls and gain root-level command execution. The vulnerabilities, CVE-2026-116606 and CVE-2026-111560, affect multiple Barracuda appliances, with patches released for all impacted systems. The company urges customers to apply firmware updates immediately. Historical context includes prior exploitation of ESG flaws by the UNC4841 threat group, which used zero-days to deploy custom malware like SeaSpy and Saltwater in long-running espionage campaigns targeting government agencies and other organizations.

bleeping-computer ·14h ago