UNC5174__2025__CERTFR-2025-CTI-009.pdf

ANSSI's report documents the Houken intrusion set exploiting Ivanti CSA zero-days to gain initial access, deploying web shells and a rootkit, using diverse infrastructure and publicly available tools, with links to UNC5174; it highlights observed data exfiltration and a cryptomining capability, suggesting a sophisticated, likely multi-actor operation with potential for future campaigns.