Chinese snoops use stealth RAT to backdoor US orgs – still active last week – Source: go.theregister.com

A cyberspy crew or individual with ties to China’s Ministry of State Security has infected global organizations with a remote access trojan (RAT) that’s “even better” than Cobalt Strike, using this stealthy backdoor to enable its espionage and access resale campaigns.

The attacker, dubbed UNC5174, uses a mix of custom and open source malware, including its own SNOWLIGHT dropper and a new open source, in-memory backdoor VShell, according to a report penned by the Sysdig Threat Research Team and shared with The Register ahead of its Tuesday publication.

In addition to the fileless backdoor, which has gained a reputation on cybercrime forums as being “even better” than Cobalt Strike, UNC5174 has also used new command and control infrastructure since January.

VShell is a particularly stealthy backdoor that became available on GitHub in 2024. It has been misused for nefarious purposes since the start, primarily to access and control computers remotely, and to allow miscreants to upload and download files from victims’ machines.

Because the malware lives in memory and doesn’t touch the disk, it’s especially hard to detect using file-based scanning, allowing the snoops to remain hidden for much longer.

In this attack, upon gaining access to victims’ machines, the malicious bash script downloads and executes two payloads: dnsloger, which is part of the SNOWLIGHT malware family, and system_worker, which drops a Sliver implant and VShell.

While the Sysdig Threat Research Team (TRT) doesn’t know what the digital intruders are using for initial access, they have been spotted targeting Linux systems. The team assesses “with high confidence” that the new infrastructure is being used for domain squatting – most likely for use in phishing or social engineering attacks. These domains spoof well-known companies, most recently Cloudflare, while others have impersonated Telegram, Google, and financial services firm Huione Pay.

The group’s most recent campaign has primarily targeted US-based organizations, although indicators of compromise (IOCs) linked to SNOWLIGHT were also spotted in Hong Kong, Taiwan, Japan, Germany, and France. 

“In 2025 alone, Sysdig TRT has detected more than 40 examples of IOCs with VShell that indicate UNC5174 as the threat actor – the latest of which was actually seen today, April 11,” Sysdig threat detection engineer Alessandra Rizzo told The Register last Friday.

New domains are “popping up almost daily, from which TRT is deriving these samples – they’re also regularly switching the brands they impersonate,” Rizzo said. “Also, since VShell is a cross-platform malware, it can be used on macOS and Windows platforms.”

The report predicts “with moderate confidence” that UNC5174 will “provide occasional support to the Chinese government in the future” and continue using its new infrastructure alongside its growing malware and open source tool arsenal for “espionage and access brokering.”

UNC5174 and SNOWLIGHT

The last known sighting of UNC5174 came in early 2024, when the snoops exploited critical-severity bugs in F5 and ConnectWise gear to sell access to compromised US defense organizations, UK government agencies, and hundreds of other entities.

At the time, Mandiant said it believed UNC5174 was likely acting as a contractor for China’s Ministry of State Security focused on executing access operations. Mandiant also spotted a new dropper, SNOWLIGHT, being used in these attacks, and attributed the malware to UNC5174.

In 2025, the Sysdig threat hunters were examining VirusTotal tags for the SNOWLIGHT sample and spotted one dropping a VShell binary in a similar manner. This was first detected in November, and the team spotted several more after that, including the dnsloger sample used in this most recent campaign.

“It is reasonable to assume that this campaign has continued to operate without much public attention since November 2024,” the researchers wrote.

• Chinese snoops use F5, ConnectWise bugs to sell access into top US, UK networks
• It’s only a matter of time before LLMs jump start supply-chain attacks
• China reportedly admitted directing cyberattacks on US infrastructure
• Infosec experts fear China could retaliate against tariffs with a Typhoon attack

The VShell binary also led the team to a new UNC5174 domain, this one spoofing Google (googlespays[.]com), which matched the pattern of the Chinese spies’ current C2 domain along with parameters needed to extract the VShell binaries.

According to the threat intel team: “The November 2024 VShell binary also uses a WebSocket protocol over the C2 domain apib[.]googlespays[.]com, the same attack chain and distinguishable features that we observed with the newest samples and domains.”

VShell: The even better Cobalt Strike

The VShell developer reportedly deleted the software release for legal reasons. However, it’s still circulating online, and although the license has expired, it can be configured by bypassing the license expiration. Plus, several clone repositories on GitHub contain VShell and instructions on how to use it.

Using WebSockets for command and control is also noteworthy, and a “distinguishing feature of this campaign,” according to the researchers. The attacker configured VShell to run on the HTTPS port (8443), which means it can be sent in real time and over encrypted traffic, making it more difficult for anti-virus products to detect as malware. 

All of these tools work together to provide the snoops with “stealth and persistence” to the compromised computers, Sysdig Cybersecurity Strategist Crystal Morin told The Register.

“Since VShell is fileless malware, it can easily go unnoticed until the threat actor (or the individual to which the access was sold) decides to make a move,” she said. 

“The command and control techniques of this campaign (employing WebSockets) allow them to exfiltrate data from the victim’s environment and send it as encrypted payloads, which is an uncommon technique for most attackers,” Morin added. “Because of this we are confident that the threat actor UNC5174 is still likely conducting espionage and access resale campaigns.” ®