UNC3524, an emerging advanced persistent threat (APT) group tracked by Mandiant, has been observed breaching corporate networks to target “executive teams and employees that work in corporate development, mergers, and acquisitions, or IT security staff.” The threat group’s goal is to gain privileged credentials from these specific targets’ mail environments in order to make Exchange Web Services (EWS) API requests to Microsoft Exchange or Microsoft 365 Exchange Online environments in order to exfiltrate emails. The exfiltrated emails span over a specified date range rather than through keyword-filtering, which is a tactic utilized by Russian-backed threat group Cozy Bear. In addition to tactics linked to Cozy Bear, researchers have noted that UNC3524 has used tools and tactics previously linked to Russian-backed Fancy Bear, or APT28, but there is currently not enough high-confidence attribution for a linkage to be defined. UNC3524 is described by researchers as “advanced” and “stealthy,” as the group has the ability to remain undetected on a compromised system for a longer time period than average (which is twenty-one days as reported in 2021 by Mandiant). The longest time period currently identified is eighteen (18) months. The threat group does this by installing backdoors on “appliances within victim environments that do not support security tools, such as antivirus or endpoint protection.” Researchers observed UNC3524 utilizing “QUIETEXIT”, a newly identified backdoor, for persistent remote access as well as a reGeorg web shell on a DMZ web server as an alternative access point. An in-depth technical analysis of UNC3524 recent activity as well as indicators of compromise (IOCs) can be viewed in Mandiant’s report linked below.