APT5 / Mulberry Typhoon

Overview

APT5 — designated Mulberry Typhoon by Microsoft (formerly MANGANESE under Microsoft's pre-Typhoon naming), Bronze Fleetwood by SecureWorks, and Keyhole Panda by CrowdStrike — is one of the most technically distinctive Chinese espionage groups in the documented threat landscape. Unlike peer Chinese APT groups that pursue broad economic or political intelligence mandates, APT5 has maintained an unusually focused mission over a documented 15+ year operational history: telecommunications infrastructure, satellite communications systems, and the military and defense organizations that depend on them.

Mandiant's characterization of APT5 is stark: over half of the organizations the group has been observed targeting or breaching operate in the telecom or technology sectors. This is not incidental focus but a coherent, sustained intelligence collection mandate aligned with China's strategic interest in understanding, monitoring, and where necessary disrupting the communications infrastructure of adversary states and regional competitors. Satellite communications — specifically, who uses them, what they carry, how they work, and what their vulnerabilities are — appear to be a primary intelligence target in ways that go beyond simple IP theft.

What distinguishes APT5 from a technical standpoint is its documented preference for attacking the network infrastructure itself rather than simply using network access as a pathway to endpoint targets. The group has been documented modifying router images, tampering with networking device operating systems, and — in the Pulse Secure and Citrix ADC campaigns — implanting malware directly into the binaries and scripts of VPN gateway appliances in ways designed to survive software updates and factory resets. This appliance-level persistence is technically sophisticated and operationally valuable: an implanted VPN gateway gives access to every user who authenticates through it, credential harvesting at scale without touching individual endpoints.

APT5 appears to be a large group composed of several distinct subgroups with varying tactics and infrastructure. The UNC2630 cluster — assessed with high confidence as APT5-affiliated based on strong TTP similarities to documented APT5 activity from 2014 and 2015 — operated with tooling and infrastructure distinct from previously documented APT5 campaigns, yet the targeting, on-network behavior, and affinity for networking device exploitation were unmistakably consistent with the broader APT5 profile. This multi-subgroup structure is consistent with MSS-affiliated operations, which Mandiant has characterized as having a broader geographic scope and more diverse operational architecture than PLA-affiliated groups.

Target Profile

APT5's targeting is defined by a consistent hierarchy: telecommunications infrastructure is primary, satellite communications systems are a persistent sub-focus within that, and defense organizations with military communications dependencies are a consistent secondary target. The geographic emphasis on Southeast Asia and South Asia reflects the strategic communications competition in those regions — the South China Sea, Taiwan Strait, and India-China border areas all depend heavily on the communications infrastructure APT5 targets.

• Regional Telecommunications Providers: The anchor target category. APT5 targets telecommunications carriers both for the intelligence value of the communications they carry and for the network access they provide to subscribers. A compromised carrier — particularly one providing services to government or military clients — is a collection platform of extraordinary value. In late 2014, APT5 breached an international telecommunications company's network, demonstrating the group's ability to operate inside major carrier infrastructure.
• Satellite Communications Systems and Providers: Mandiant specifically notes that APT5's focus within telecom is particularly concentrated on satellite communications. SATCOM providers, satellite ground station operators, and organizations that manage satellite command-and-control infrastructure are targeted for both intelligence collection (understanding satellite capabilities and coverage) and potentially for positioning that could enable future disruption. Satellite communications underpin military operations, maritime navigation in disputed seas, and diplomatic communications in ways that make them strategically critical collection targets.
• Aerospace and Defense: Organizations developing aerospace technology, defense electronics, unmanned aerial vehicle systems, and military communications equipment are targeted for technical intelligence. APT5 stole files from a South Asian defense organization related to product specifications, procurement bids, emails about technical products, and — specifically — documents on unmanned aerial vehicles. The UAV interest is consistent with China's documented military UAV development priorities and intelligence-gathering on adversary platforms.
• Defense Industrial Base: UNC2630 (APT5-affiliated) specifically targeted U.S. Defense Industrial Base companies from August 2020 through March 2021 via Pulse Secure VPN exploitation — harvesting credentials and maintaining persistent access across organizations that develop and supply defense technologies. The targeting aligned with Chinese government priorities outlined in China's 14th Five Year Plan.
• Electronics Firms with Military Clients: APT5 targeted an electronics firm that sells products for both industrial and military applications, then stole communications related to the firm's business relationship with a national military — including inventories and memoranda about specific products supplied. This represents the supply chain espionage approach: targeting a vendor to understand their military client's capabilities and procurement.
• Asia-Based Employees of Global Firms: APT5 specifically targets employees based in Southeast Asia at global telecommunications and technology firms. This regional focus reflects both the geographic competition around the South China Sea and the South Asia theater, and an intelligence mandate to understand the telecommunications infrastructure supporting U.S. and allied military operations in the region.
• High-Technology Manufacturing: Technology manufacturers — particularly those producing components and systems used in telecom, aerospace, and defense — are targeted for technology blueprints, manufacturing processes, and product specifications consistent with China's industrial policy objectives.

Tactics, Techniques & Procedures

APT5's most technically distinctive characteristic — and the one that earned a dedicated NSA advisory — is its systematic targeting of network edge devices not as entry points to be passed through, but as persistent access platforms to be weaponized in place. Modifying the binaries of a VPN gateway or application delivery controller to survive software updates and factory resets is a capability that requires deep product knowledge and represents a qualitatively different level of access than a typical endpoint compromise.

mitre id	technique	description
T1190	Exploit Public-Facing Application	APT5 has a documented pattern of exploiting zero-day and recently disclosed vulnerabilities in internet-facing network appliances. CVE-2022-27518 (Citrix ADC/Gateway — pre-authenticated remote code execution) was exploited as a zero-day by APT5 before Citrix had issued a patch. CVE-2021-22893 (Pulse Connect Secure — authentication bypass and remote code execution, CVSS 10.0) was exploited by UNC2630/APT5-affiliated actors against U.S. Defense Industrial Base networks. Earlier, APT5 exploited vulnerabilities in Pulse Secure VPN in 2019 (CVE-2019-11510) and 2020. The pattern is consistent: zero-day or near-zero-day exploitation of the authentication layer of enterprise remote access infrastructure.
T1601.001	Patch System Image — Modify Legitimate Binary	APT5's signature persistence technique. After gaining access to a Citrix ADC or Pulse Secure VPN appliance, the group modifies legitimate binaries within the device's operating system to maintain persistent access. For Citrix ADC, NSA warned that even upgrading to a patched version may not remove the compromise because modified binaries persist. For Pulse Secure, Mandiant found that modified scripts survived software updates and factory resets. Key executables monitored for modification include nsppe, nsaaad, nsconf, nsreadfile, and nsconmsg (Citrix). The deep product knowledge required to implement these modifications without disrupting device functionality indicates targeted research or insider knowledge of the appliance software.
T1556	Modify Authentication Process	The SLOWPULSE malware deployed on Pulse Secure VPN appliances specifically modifies the authentication routines on the device. Variant 1 bypasses LDAP and RADIUS-based two-factor authentication by inspecting login credentials at the start of the authentication routine and forcing execution down the successful authentication path if a secret backdoor password is provided by the attacker. This gives APT5 operators the ability to authenticate to any Pulse Secure VPN using a hidden backdoor password that bypasses MFA — providing access to target networks even after password resets and MFA enrollment changes.
T1505.003	Web Shell	APT5 injects web shells into internet-accessible administrative web pages on compromised Pulse Secure VPN appliances. Web shells like ATRIUM and SLIGHTPULSE provide persistent command access through the appliance's administrative interface. After CISA issued its emergency directive in April 2021, Mandiant observed UNC2630 operators accessing dozens of compromised devices and removing web shells — indicating the group monitors the security news cycle and responds to disclosure events.
T1078	Valid Accounts — Credential Harvesting	A primary post-exploitation objective. APT5 harvests credentials from VPN login flows on compromised appliances, then uses those legitimate credentials for lateral movement into the target network. This approach is particularly effective because credential-based access produces authentication events that appear legitimate, blending with normal user activity and defeating controls that focus on detecting malware rather than anomalous authentication patterns. The group uses keylogging-capable malware to target corporate networks and harvest executive-level credentials.
T1027	Obfuscated Files / Anti-Forensics	APT5 uses multiple malware families with capabilities specifically designed to remove forensic evidence: PULSECHECK, SLIGHTPULSE, and other Pulse Secure-specific tools include functionality to delete utilities and scripts after use to impede incident response. The group also exploited a vulnerability in the Pulse Secure Integrity Checker Tool (ICT) — the recommended detection mechanism — by persisting backdoors on the rollback partition of appliances, which the ICT cannot scan. Appliances that appeared clean under ICT scanning could still be compromised.
T1040	Network Sniffing	Controlling a VPN gateway or application delivery controller provides intrinsic network sniffing capability at the authentication and session layer. APT5's appliance-level persistence is itself a persistent network collection platform — every user who authenticates through a compromised VPN gateway passes their credentials through an attacker-controlled authentication process. This is fundamentally different from endpoint-level collection and can capture credentials for users who never have malware on their own machines.
T1595	Active Scanning	APT5 conducts network reconnaissance scanning through operational relay box (ORB) networks — specifically the SPACEHOP ORB network documented by Intel 471 — to conduct reconnaissance and exploit vulnerabilities while obscuring the source of attacks. ORB networks use compromised routers and other infrastructure as proxy hops, complicating attribution and blocking of attacker infrastructure.

Known Campaigns

APT5's campaign history reveals a group that repeatedly returns to the same technique class — exploiting authentication and remote access infrastructure — while evolving the specific products it targets as enterprise technology evolves. The shift from VPN gateways (2019–2021) to application delivery controllers (2022) reflects deliberate adaptation as defenders focused remediation attention on one product category, and the group pivoted to another serving the same role in the enterprise network.

Tools & Malware

APT5's toolset divides clearly into two categories: general-purpose custom tools used across campaigns, and appliance-specific malware families purpose-built for individual network product targets. The Pulse Secure campaign produced 12 distinct malware families — all specifically designed to operate within Pulse Secure's proprietary OS environment. This level of product-specific tool development requires either reverse engineering the target product or access to insider knowledge, and reflects the group's investment in deep technical expertise on the specific platforms it targets.

• SLOWPULSE: A Trojan deployed on Pulse Secure VPN appliances by modifying existing shared library files. Multiple variants: Variant 1 bypasses LDAP and RADIUS two-factor authentication by inspecting credentials at the beginning of authentication routines and redirecting successful authentication if a secret backdoor password is provided. Variant 2 patches the authentication flow differently. Both variants are designed to appear as modifications to legitimate Pulse Secure files rather than new malware introductions, complicating detection.
• RADIALPULSE: A web shell implant injected into Pulse Secure VPN administrative interfaces. Provides command execution capability through the appliance's web management interface, accessible to operators with network access to the management plane.
• THINBLOOD: A Pulse Secure-specific utility in UNC2630's toolkit, providing system-level access and data collection capability on compromised appliances.
• ATRIUM: A web shell used by UNC2630 on Pulse Secure appliances. Mandiant observed operators accessing compromised devices to remove ATRIUM web shells in the days after CISA's emergency directive — indicating the group actively monitors public disclosure and responds to remediation campaigns.
• PACEMAKER: An additional Pulse Secure-specific malware family providing persistent remote access and credential collection capability within the compromised appliance environment.
• SLIGHTPULSE: A Pulse Secure-specific tool with credential harvesting and forensic evidence removal capabilities — specifically designed to delete utilities and scripts after use to complicate post-incident forensic analysis.
• PULSECHECK: A Pulse Secure web shell providing persistent command interface access on compromised appliances, used in conjunction with other UNC2630 tools for maintaining access during extended operations.
• Keylogging Malware (general): Mandiant and CERT-EU have documented APT5's use of malware with keylogging capabilities specifically targeted at telecommunication companies' corporate networks, employees, and executives. Keylogging enables collection of authentication credentials, sensitive communications, and operational discussions without network-level access to email or file servers.
• BRIGHTCREST / SWEETCOLA: Custom tools attributed to APT5 in cloud and broader network targeting contexts, documented in Wiz cloud threat intelligence reporting. Provide C2 and data collection capabilities in targeted environments.
• TRAILBLAZE: An in-memory-only dropper deployed by UNC5221 after exploitation of CVE-2025-22457 (Ivanti Connect Secure). Executes via a multi-stage shell script dropper and injects BRUSHFIRE into memory — leaving minimal disk artifacts, making it extremely difficult to detect through file-based scanning.
• BRUSHFIRE: A passive backdoor deployed by UNC5221 alongside TRAILBLAZE. Hooks SSL functions on the compromised appliance to receive commands — meaning it activates only when the operator reaches out, generating no outbound traffic patterns that would alert network monitoring tools.
• SPAWN ecosystem (SPAWNANT / SPAWNMOLE / SPAWNSNAIL / SPAWNSLOTH / SPAWNCHIMERA / SPAWNWAVE): A family of Ivanti Connect Secure-specific malware deployed by UNC5221 across multiple campaigns from 2024–2025. SPAWNANT installs other SPAWN components; SPAWNMOLE is a SOCKS5 tunneler; SPAWNSNAIL is an SSH backdoor; SPAWNSLOTH is a log wiper that targets the dslogserver process to disable local and remote syslog forwarding; SPAWNCHIMERA combines multiple SPAWN capabilities; SPAWNWAVE combines SPAWNCHIMERA and RESURGE functionality. The SPAWN family demonstrates purpose-built appliance malware development at the same level documented for APT5's UNC2630 Pulse Secure toolset.
• BRICKSTORM: A Go-language backdoor with SOCKS proxy functionality deployed by UNC5221 against VMware vCenter and ESXi hosts post-initial-access. Observed on Linux and BSD-based appliances from multiple manufacturers. UNC5221 has shown a consistent pattern of targeting VMware vCenter and ESXi alongside VPN appliance exploitation — creating multiple persistent access paths into compromised organizations.

Indicators of Compromise

The following IOCs are drawn from the NSA's December 2022 APT5 Citrix ADC Threat Hunting Guidance, Mandiant's April and May 2021 Pulse Secure reporting, and Mandiant's foundational APT5 profile. For current APT5 threats to Citrix and VPN environments, prioritize behavioral detection over hash-based indicators.

Mitigation & Defense

APT5 is active and has demonstrated a consistent strategic preference for exploiting remote access and authentication infrastructure — a category of network edge device that grows in importance and attack surface with every expansion of remote work. Organizations with Citrix ADC, Citrix Gateway, Pulse Secure (now Ivanti), or other enterprise VPN/ADC infrastructure in their environment should treat APT5 as a directly relevant, active threat.

• Network Appliance Binary Integrity Monitoring: APT5's defining TTP — modifying legitimate appliance binaries — requires that defenders move beyond patch management to active binary integrity verification. Implement regular scheduled comparison of key executable hashes against known-good vendor images for all internet-facing network appliances. For Citrix ADC, NSA specifically identified nsppe, nsaaad, nsconf, nsreadfile, and nsconmsg as key executables to verify. Automate this comparison where possible; manual hash checking is likely to be inconsistent. Ensure hash verification is done against vendor-provided reference hashes, not against the device's own stored copies — which may themselves be modified.
• Off-Device Log Forwarding — Mandatory: APT5 clears on-device logs and tampers with log integrity after exploitation. Forward all appliance logs to a remote SIEM in near-real-time so that on-device tampering cannot retroactively eliminate evidence. For Citrix ADC, NSA specifically recommends off-device logging for dmesg and ns.log. Monitor for log gaps — a period of missing logs on an appliance that was previously logging normally is itself a strong indicator of compromise.
• SAML Configuration Review: CVE-2022-27518 only affects Citrix ADC and Gateway configured as SAML service providers or SAML identity providers. Organizations not using SAML authentication on their Citrix deployments are not vulnerable to this specific CVE. Audit all Citrix deployments to confirm SAML configuration necessity — disable SAML SP/IdP configuration on any device that does not require it. This reduces attack surface even for future undisclosed vulnerabilities in SAML processing code paths.
• VPN and ADC Placement Behind Additional Authentication: The NSA's guidance for compromised Citrix environments recommends moving Citrix ADC instances behind a VPN or another capability requiring valid user authentication (preferably multi-factor) prior to reaching the ADC itself. Applying this principle proactively — not just in response to a known compromise — significantly raises the cost of exploitation. An attacker who needs to first exploit a VPN gateway to reach a Citrix ADC has two appliances to compromise rather than one.
• Appliance Reimaging Policy for Suspected Compromises: Given APT5's documented ability to persist through software updates and factory resets via modified binaries and rollback partition backdoors, any Citrix ADC or Pulse Secure/Ivanti device that ran vulnerable software during the exploitation window of known APT5 CVEs should be treated as potentially compromised. Patching is not sufficient — full reimaging from a clean vendor image is required for confirmed or suspected compromises. Budget and plan for this operationally before an incident occurs.
• Credential Reset Scope: APT5 harvests credentials from VPN login flows on compromised appliances. After any suspected APT5 appliance compromise, Ivanti and Mandiant both recommend resetting all passwords in the environment — not just the VPN accounts. Credentials captured from VPN authentication flows include Active Directory domain credentials that may be used across the entire enterprise. Partial credential resets that miss accounts whose credentials were captured will leave APT5 access pathways intact even after appliance remediation.
• Telecom and Satellite Communications Sector Specific Controls: Organizations in the telecommunications sector, satellite communications, and defense supply chain should treat APT5 as a persistent and motivated threat with a decade-plus track record of successful intrusions in exactly their sectors. Implement network segmentation that isolates critical communications infrastructure from standard enterprise IT networks. Apply enhanced monitoring to authentication events for systems that route or manage communications traffic. Verify the integrity of any networking equipment involved in sensitive communications pathways on a regular schedule.

Sources & Further Reading

Attribution and references used to build this profile.

• MITRE ATT&CK — Group G1023: APT5
• NSA — APT5: Citrix ADC Threat Hunting Guidance (December 2022)
• Mandiant (Google Cloud) — Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day (2021)
• Mandiant (Google Cloud) — Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices (2021)
• Mandiant (Google Cloud) — Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation — CVE-2023-46805 + CVE-2024-21887 (January 2024)
• Google Threat Intelligence Group — Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability CVE-2025-22457 (April 3, 2025)
• Malpedia — APT5 Actor Profile
• Council on Foreign Relations — Cyber Operations Tracker: APT 5
• SecureWorks CTU — Bronze Fleetwood Threat Profile
• Industrial Cyber — NSA Warns of Chinese Hacker Group APT5 Targeting Citrix ADC Vulnerabilities (2022)