UNC5174
Also known as UNC6586
Reports
6
First seen
Nov 1, 2025
Last seen
Sep 3, 2026
Motivation
Espionage, Financial
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Sectors
Victim regions
United States ×1
Top ATT&CK techniques
T1190 Exploit Public-Facing Application ×6T1566 Phishing ×4T1003 OS Credential Dumping ×3T1505.003 Web Shell ×3T1486 Data Encrypted for Impact ×3T1555 Credentials from Password Stores ×2T1598 Phishing for Information ×2T1547 Boot or Logon Autostart Execution ×2T1070.001 Indicator Removal: Clear Windows Event Logs ×2T1087 Account Discovery ×1T1021 Remote Services ×1T1219 Remote Access Software ×1
Indicators
filename ×39hash_sha256 ×31cve ×16url ×13ip_v4 ×10domain ×10
Indicator values are available on Pro and via the API.
Associated CVEs
CVE-2025-49113 (exploited)CVE-2026-58231 (exploited)CVE-2025-0994 (exploited)CVE-2025-27915 (exploited)CVE-2025-31324 (exploited)CVE-2025-41244 (exploited)CVE-2025-55182 (exploited)CVE-2026-33824 (exploited)CVE-2026-60004 (exploited)CVE-2026-64849 (exploited)CVE-2026-65400 (exploited)CVE-2021-26829 (exploited)CVE-2026-68820 (exploited)CVE-2024-42009 (exploited)
Recent reports
High