UNC3524__2022__UNC3524_Eye_Spy_on_Your_Email_Mandiant.pdf

Mandiant outlines UNC3524, a sophisticated espionage threat actor targeting corporate development and M&A teams, using backdoors like QUIETEXIT on IoT and other appliances to maintain long-term access, tunneling over SSH, and Exchange Web Services data collection to harvest mailbox contents, while employing stealthy infrastructure and fallbacks (including REGEORG web shells) to avoid detection and sustain operations.