Sysdig researchers say UNC5174’s use of open-source tools like VShell and WebSockets has likely helped the group mask its presence in other campaigns.

The credentials are likely for future phishing and spam campaigns, Sysdig researchers said.

The company specializes in platforms that help developers monitor and protect their containers and microservices.