Unveiling the China-Linked Cyber Threat: UAT-7290's Malicious Campaign
In a recent development, a threat actor with ties to China, known as UAT-7290, has been identified as the mastermind behind a series of espionage-focused intrusions targeting entities in South Asia and Southeastern Europe. But here's where it gets controversial: this group's tactics extend beyond traditional espionage, and their activities have sparked a debate among cybersecurity experts.
According to a comprehensive report by Cisco Talos, UAT-7290's modus operandi involves extensive technical reconnaissance, a crucial step often overlooked by many threat actors. By thoroughly studying their targets, they gain an edge in launching precise and effective attacks. The group's primary objective is to deploy a range of malware families, including RushDrop, DriveSwitch, and SilentRaid, each with its unique capabilities.
"UAT-7290's tactics, techniques, and procedures (TTPs) suggest a dual role. While they excel at burrowing deep into victim networks for espionage purposes, they also establish Operational Relay Box (ORBs) nodes, potentially providing access to other China-linked actors," explained researchers Asheer Malhotra, Vitor Ventura, and Brandon White.
The impact of UAT-7290's activities has primarily been felt in the telecommunications sector of South Asia. However, their recent intrusion waves have expanded to target organizations in Southeastern Europe, indicating a growing scope of their operations.
UAT-7290's tradecraft is a diverse mix of open-source malware, custom tools, and payloads targeting 1-day vulnerabilities in popular edge networking products. Among their notable Windows implants are RedLeaves and ShadowPad, both exclusively linked to Chinese hacking groups. But their primary focus lies in a Linux-based malware suite, which includes RushDrop, a dropper initiating the infection chain; DriveSwitch, a peripheral malware executing SilentRaid; and SilentRaid itself, a C++-based implant ensuring persistent access to compromised endpoints.
A previous analysis by QiAnXin XLab flagged SilentRaid as a variant of ChronosRAT, a modular ELF binary capable of executing a wide range of malicious activities. This finding adds another layer of complexity to the group's operations.
UAT-7290 also deploys a backdoor called Bulbature, designed to transform compromised edge devices into ORBs. First documented by Sekoia in 2024, this backdoor highlights the group's ability to adapt and innovate.
The cybersecurity company Sekoia draws parallels between UAT-7290 and other China-linked adversaries, such as Stone Panda and RedFoxtrot (aka Nomad Panda). This connection further emphasizes the group's strategic importance and potential impact.
"UAT-7290's extensive reconnaissance and use of one-day exploits and SSH brute force demonstrate a sophisticated approach. Their reliance on publicly available exploit code raises questions about their motivations and capabilities," the researchers noted.
As we delve deeper into the world of cybersecurity, it's crucial to stay informed about such threats. Follow us on Google News, Twitter, and LinkedIn to stay updated with exclusive content and insights into the ever-evolving landscape of cyber threats.
