{“lastseen”:”2026-01-08T14:05:10″,”description”:”* Cisco Talos is disclosing a sophisticated threat actor we track as UAT-7290, who has been active since at least 2022.\\n * UAT-7290 is tasked with gaining initial access as well as conducting espionage focused intrusions against critical infrastructure entities in South Asia.\\n * UAT-7290’s arsenal includes a malware family consisting of implants we call RushDrop, DriveSwitch, and SilentRaid.\\n * Our findings indicate that UAT-7290 conducts extensive technical reconnaissance of target organizations before carrying out intrusions.\\n\\n\\n\\n* * *\\n\\n\\n\\nTalos assesses with high confidence that UAT-7290 is a sophisticated threat actor falling under the China-nexus of Advanced Persistent Threat actors (APTs). UAT-7290 primarily targets telecommunications providers in South Asia. However, in recent months we have also seen UAT-7290 expand their targeting into Southeastern Europe.\\n\\nIn addition to conducting espionage focused attacks where UAT-7290 burrows deep inside a victim enterprise’s network infrastructure, their tactics, techniques and procedures (TTPs) and tooling suggests that this actor also establishes Operational Relay Box (ORBs) nodes. The ORB infrastructure may then be used by other China-nexus actors in their malicious operations, signifying UAT-7290’s dual role as an espionage motivated threat actor as well as an initial access group.\\n\\nActive since at least 2022, UAT-7290 has an expansive arsenal of tooling, including open-source malware, custom developed malware, and payloads for 1-day vulnerabilities in popular edge networking products. UAT-7290 primarily leverages a Linux based malware suite but may also utilize Windows based bespoke implants such as RedLeaves or Shadowpad commonly linked to China-nexus threat actors.\\n\\nOur findings suggest that the threat actor conducts extensive reconnaissance of target organizations before carrying out intrusions. UAT-7290 leverages one-day exploits and target-specific SSH brute force to compromise public facing edge devices to gain initial access and escalate privileges on compromised systems. The actor appears to rely on publicly available proof-of-concept exploit code as opposed to developing their own.\\n\\nUAT-7290 shares overlapping TTPs with known China-nexus adversaries, including the exploitation of high-profile vulnerabilities in networking devices, use of open-source web shells for persistence, leveraging UDP listeners, and using compromised infrastructure to facilitate operations.\\n\\nSpecifically, we have observed technical indicators that overlap with RedLeaves, a malware family attributed to APT10 (a.k.a. MenuPass, POTASSIUM and Purple Typhoon), as well as infrastructure associated with ShadowPad, a malware family used by a variety of China-nexus adversaries.\\n\\nAdditionally, UAT-7290 shares a significant amount of overlap in victimology, infrastructure, and tooling with a group publicly reported by Recorded Future as Red Foxtrot. In a 2021 report, Recorded Future linked Red Foxtrot to Chinese People’s Liberation Army (PLA) Unit 69010.\\n\\n## UAT-7290’s malware arsenal for edge devices\\n\\nTalos currently tracks the Linux-based malware families associated with UAT-7290 in this intrusion as:\\n\\n * RushDrop – The dropper that kickstarts the infection chain. RushDrop is also known as ChronosRAT.\\n * DriveSwitch – A peripheral malware used to execute the main implant on the infected system.\\n * SilentRaid – The main implant in the intrusion meant to establish persistent access to compromised endpoints. It communicates with its command-and-control server (C2) and carries out tasks defined in the malware. SilentRaid is also known as MystRodX.\\n\\n\\n\\nAnother malware implanted on compromised devices by UAT-7290 is Bulbature. Bulbature, first disclosed by Sekoia in late 2024, is an implant that is used to convert compromised devices into ORBs.\\n\\n### RushDrop and DriveSwitch\\n\\nRushDrop is a malware dropper that consists of three binaries encoded and embedded within it. RushDrop first makes rudimentary checks to ensure it is running on a legitimate system instead of a sandbox.\\n\\nFigure 1. RushDrop deleting itself if VM checks fail.\\n\\nThen it either checks for the existence of, or creates a folder called \\”.pkgdb\\” in the current working directory of the dropper. RushDrop then decodes and drops three binaries to the \\”.pkgdb\\” folder:\\n\\n * \\”daytime\\” \\\\- A malware family that simply executes a file called \\”chargen\\” from the current working directory. This executor is being tracked as DriveSwitch.\\n * \\”chargen\\” \\\\- The central implant of the infection chain, tracked as SilentRaid. SilentRaid communicates with its C2 server, usually in the form of a domain and can carry out action as instructed by the C2.\\n * \\”busybox\\” \\\\- Busybox is a legitimate Linux utility that can be used to execute arbitrary commands on the system.\\n\\nFigure 2. RushDrop setting up files on disk.\\n\\nDriveSwitch simply executes the SilentRaid malware on the system.\\n\\nFigure 3. DriveSwitch executing SilentRaid.\\n\\n### SilentRaid: The multifunctional malware\\n\\nSilentRaid is a malware written in C++ and consists of multiple functionalities, written in the form of \\”plugins\\” embedded in the malware. On execution, it does certain rudimentary anti-VM and analysis checks to ensure it isn’t running in a sandbox. Then the malware simply initializes its \\”plugins\\” and contacts the C2 server for instructions to carry out malicious tasks on the infected endpoint. The plugins are built in functionalities, but modular enough to enable the threat actor to stitch together a combination of them during compilation.\\n\\n**Plugin: my_socks_mgr**\\n\\nThis plugin handles communication to C2 server. It obtains the C2 IP by resolving a domain using \\”8[.]8[.]8[.]8\\” and passes commands received from the C2 to the appropriate plugin.\\n\\n**Plugin:my_rsh**\\n\\nThis plugin opens a remote shell by executing \\”sh\\” either via either \\”busybox\\” or \\”\/bin\/sh\\”. This remote shell is then used to run arbitrary commands on the infected system.\\n\\n\\n\\n**Plugin:port_fwd_mgr**\\n\\nThis plugin sets up port forwarding between ports specified — a local port and a port on a remote server. It can also set up port forwarding across multiple ports.\\n\\n**Plugin:my_file_mgr**\\n\\nThis is the file manager of the backdoor. It allows the SilentRaid to:\\n\\n * Read contents of \\”\/etc\/passwd\\”\\n * Execute a specified file on the system\\n * Archive directories specified by the C2 using \\”tar -cvf\\” \\\\- executed via busybox\\n * Check if a file is accessible\\n * Remove a file or directory using the \\”rm\\” command – via busybox\\n * Read\/write a specified file\\n\\n\\n\\nSilentRaid can also parse thru x509 certificates and collect attribute information such as:\\n\\n * id-at-dnQualifier | Distinguished Name qualifier\\n * id-at-pseudonym | Pseudonym\\n * id-domainComponent | Domain component\\n * id-at-uniqueIdentifier | Unique Identifier\\n\\n\\n\\n### Bulbature\\n\\nThe Bulbature malware discovered consisted of the same string encoding scheme as the other UAT-7290’s malware illustrated earlier. Usually UPX compressed, Bulbature can bind to and listen to either a random port of its choosing or one specified via command line via the \\”-d \\u003cport_number\\u003e\\” switch.\\n\\nBulbature obtains the local network interface’s name by executing the command:\\n \\n \\n cat \/proc\/net\/route | awk ‘{print $1,$2}’ | awk ‘\/00000000\/ {print $1}’\\n \\n\\nIt also obtains basic system information and the current user using the command:\\n \\n \\n echo $(whoami) $(uname -nrm)\\n \\n\\nThe malware typically records its C2 address in a config file in the \/tmp directory. The file will have the same name as the malware binary with the \\”.cfg\\” extension appended to it. The C2 address may be an encoded string.\\n\\nBulbature can obtain additional or new C2 addresses from the current C2 and can switch over communications with them instead. The malware can open up a reverse shell with its C2 to execute arbitrary commands on the infected system.\\n\\nA recent variant of Bulbature contained an embedded self-signed certificate that it used for communicating with the C2. This certificate matches the one from the sample disclosed by Sekoia as well:\\n \\n \\n 509 Certificate:\\n Version: 3\\n Serial Number: 81bab2934ee32534\\n Signature Algorithm:\\n \u00a0\u00a0\u00a0 Algorithm ObjectId: 1.2.840.113549.1.1.11 sha256RSA\\n \u00a0\u00a0\u00a0 Algorithm Parameters:\\n \u00a0\u00a0\u00a0 05 00\\n Issuer:\\n \u00a0\u00a0\u00a0 O=Internet Widgits Pty Ltd\\n \u00a0\u00a0\u00a0 S=Some-State\\n \u00a0\u00a0\u00a0 C=AU\\n \u00a0 Name Hash(sha1): d398f76c7ba0bbf79b1cac0620cdf4b42e505195\\n \u00a0 Name Hash(md5): 4a963519b4950845a8d76668d4d7dd29\\n \u00a0\\n NotBefore: 8\/8\/2019 3:33 AM\\n NotAfter: 12\/24\/2046 3:33 AM\\n \u00a0\\n Subject:\\n \u00a0\u00a0\u00a0 O=Internet Widgits Pty Ltd\\n \u00a0\u00a0\u00a0 S=Some-State\\n \u00a0\u00a0\u00a0 C=AU\\n \u00a0 Name Hash(sha1): d398f76c7ba0bbf79b1cac0620cdf4b42e505195\\n \u00a0 Name Hash(md5): 4a963519b4950845a8d76668d4d7dd29\\n \u00a0\\n Cert Hash(sha256): 918fb8af4998393f5195bafaead7c9ba28d8f9fb0853d5c2d75f10e35be8015a\\n \\n\\nCensys data shows that this certificate, with the exact Serial number, is present on at least 141 hosts, all either located in China or Hong Kong. On Virus Total, many of the IPs identified hosting this certificate are associated with other malware typically associated with China-nexus of threat actors such as SuperShell, GobRAT, Cobalt Strike, etc.\\n\\n## Coverage\\n\\nThe following ClamAV signatures detect and block this threat:\\n\\n * Unix.Dropper.Agent\\n * Unix.Malware.Agent\\n * Unix.Packed.Agent\\n\\n\\n\\nThe following Snort Rule (SIDs) detects and blocks this threat: 65124\\n\\n## IOCs\\n\\n723c1e59accbb781856a8407f1e64f36038e324d3f0bdb606d35c359ade08200\\n\\n59568d0e2da98bad46f0e3165bcf8adadbf724d617ccebcfdaeafbb097b81596\\n\\n961ac6942c41c959be471bd7eea6e708f3222a8a607b51d59063d5c58c54a38d”,”published”:”2026-01-08T11:00:03″,”modified”:”2026-01-08T11:00:03″,”type”:”talosblog”,”title”:”UAT-7290 targets high value telecommunications infrastructure in South Asia”,”source”:””,”references”:””,”id”:”TALOSBLOG:A642C929C260AF997B30D170C7E45436″,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/blog.talosintelligence.com\/uat-7290\/”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-08T14:05:10″,”description”:”* Cisco Talos is disclosing a sophisticated threat actor we track as UAT-7290, who has been active since at least 2022.\\n * UAT-7290 is tasked…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,13,33,7,69,11,5],"class_list":["post-34630","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-security","tag-talosblog","tag-tapic","tag-vulnerability"],"yoast_head":"\n