Uncovering the DNS Underbelly of UNC5174: The Shift from SNOWLIGHT to VShell

Chinese-sponsored group UNC5174, known for using the open-source reverse shell tool SUPERSHELL, struck again. At the start of 2025, they used a new open-source tool and command-and-control (C&C) infrastructure dubbed “SNOWLIGHT.” In this attack, they began using another tool dubbed “VShell.”

Sysdig disclosed their findings about UNC5174’s latest campaign, including 25 indicators of compromise (IoCs) comprising 13 domains and 12 IP addresses. WhoisXML API expanded the current list of IoCs, which led to the discovery of these new artifacts:

• One alleged victim IP record obtained from the Internet Abuse Signal Collective (IASC)
• Eight email-connected domains
• 13 additional IP addresses, 11 of which turned out to be malicious
• 67 IP-connected domains, three of which have already been weaponized for attacks
• 199 string-connected domains, seven of which have already figured in various malicious campaigns

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://sysdig.com/blog/unc5174-chinese-threat-actor-vshell/