UNC5135

A suspected China-linked cluster observed scanning Ivanti Connect Secure appliances during the January 2024 exploitation wave. Mandiant reported moderate-confidence links to UNC3236/Volt Typhoon but did not confirm successful exploitation by this cluster in the cited activity.