threat actor · China
UNC4841
On record in CyberSIXT · MISP Galaxy
Sources name this actor but link nothing to it yet: no CVE, technique or software is on record.
Open UNC4841's actor pageUNC4841 is a well-resourced threat actor that has utilized a wide range of malware and purpose-built tooling to enable their global espionage operations. They have been observed selectively deploying specific malware families at high priority targets, with SKIPJACK being the most widely deployed. UNC4841 primarily targeted government and technology organizations, but they have also been observed targeting other verticals.
Source: MISP Galaxy. MISP Galaxy threat-actor cluster, by the MISP Project (CC0 1.0).
- Also known as
- SLIME57
- Origin
- China
- On record in
- CyberSIXT · MISP Galaxy
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.