UAT-7290: China-Linked Malware Targeting Telecoms in South Asia and Beyond

In the ever-evolving landscape of cyber threats, a new actor has emerged, raising concerns in the South Asian region and beyond. Known as UAT-7290, this China-nexus threat actor has been linked to espionage-focused intrusions, primarily targeting telecommunications providers.

Extensive Technical Reconnaissance

UAT-7290's modus operandi involves extensive technical reconnaissance of target organizations before initiating attacks. This meticulous approach allows the actor to tailor their attacks to each specific target, increasing the chances of success.

Malware Families and ORB Nodes

The group deploys a variety of malware families, including RushDrop, DriveSwitch, and SilentRaid, among others. Notably, UAT-7290 also establishes Operational Relay Box (ORB) nodes. These nodes may be used by other China-nexus actors in their malicious operations, highlighting UAT-7290's dual role.

The Role of ORB Nodes

The ORB infrastructure established by UAT-7290 could serve as a platform for other China-nexus actors, making them a potential initial access group. This dual role as an espionage-motivated threat actor and an initial access group expands their potential impact.

Targeting Telecoms in South Asia and Southeastern Europe

While the initial focus of UAT-7290's attacks was on telecommunications providers in South Asia, recent intrusion waves have expanded to organizations in Southeastern Europe. This geographical diversification indicates an increasing threat to a broader range of entities.

Tools and Techniques

UAT-7290's toolkit includes a mix of open-source malware, custom tooling, and payloads for one-day vulnerabilities in popular edge networking products. Notable Windows implants used by the threat actor include RedLeaves and ShadowPad, both linked to Chinese hacking groups.

Relevance to North East India and India at Large

Given the focus on telecommunications providers and the expanding geographical scope of UAT-7290's attacks, it is essential for organizations in North East India to remain vigilant against cyber threats. As the digital landscape becomes increasingly interconnected, the potential for cyber attacks to impact critical infrastructure grows.

Looking Ahead

As UAT-7290 continues to evolve and adapt, it is crucial for cybersecurity professionals to stay informed about the latest threats and tactics. By understanding the methods used by actors like UAT-7290, organizations can better protect themselves and respond effectively to cyber attacks.