UNC3524__2022__Mandiant_UNC3524-Eye-Spy-Email_05-02-2022.pdf

Mandiant profiles UNC3524 as a suspected espionage threat actor targeting corporate email, deploying backdoors on IoT and network appliances (QUIETEXIT) to maintain long-term access, using SSH tunneling for covert remote access, leveraging WMIEXEC for lateral movement, and abusing Exchange Web Services to exfiltrate mailbox data, including attachments; the operation emphasizes living off compromised devices and network blind spots, making detection difficult and requiring network-based hunting and device inventory for mitigation.