UAT-7290

UAT-7290 is a China-linked threat actor tracked by Cisco Talos, assessed with high confidence to be part of the China-nexus APT ecosystem and active since at least 2022. The group conducts espionage-focused intrusions and initial access operations, primarily targeting telecommunications providers and other critical infrastructure entities in South Asia, with more recent activity extending into Southeastern Europe. Cisco Talos assessed that UAT-7290 may serve a dual role as both an espionage operator and an initial access provider by establishing Operational Relay Box (ORB) infrastructure that can later be reused by other China-nexus actors. The actor prioritizes public-facing edge networking devices for initial access. Reported access methods include extensive pre-intrusion technical reconnaissance, exploitation of one-day vulnerabilities in popular edge networking products, use of publicly available proof-of-concept exploit code, and target-specific SSH brute-force attacks against exposed devices. Talos reported that UAT-7290 burrows deeply into victim enterprise and telecommunications infrastructure during espionage operations. UAT-7290 primarily uses a Linux-focused malware suite including RushDrop, DriveSwitch, SilentRaid, and Bulbature. RushDrop, also referred to as ChronosRAT, functions as a dropper and performs anti-VM checks, creates a hidden .pkgdb directory, and drops components including daytime, chargen, and BusyBox. DriveSwitch is used to execute the main implant. SilentRaid, also known as MystRodX, is the primary persistent implant; it is described as a modular C++ backdoor that communicates with command-and-control infrastructure, including via DNS resolution using 8.8.8.8, and supports remote shell access, command execution, port forwarding, file management, reverse shell capability, and x509 certificate attribute parsing. Bulbature is used to convert compromised devices into ORB nodes; it can listen on configurable ports, store configuration in /tmp with a .cfg extension, and open reverse shells. Talos reported a recurring self-signed certificate associated with Bulbature observed on numerous hosts in China or Hong Kong. The reporting also states that UAT-7290 may use Windows implants including RedLeaves and ShadowPad. Cisco Talos observed overlaps in tooling, infrastructure, victimology, and TTPs with other China-nexus activity, including RedLeaves activity associated with APT10, ShadowPad-associated infrastructure, and the cluster known as Red Foxtrot, which prior reporting linked to PLA Unit 69010. Other reporting cited overlaps with Stone Panda, and Palo Alto Networks Unit 42 tracks related activity as CL-STA-0969. Known aliases and related names directly mentioned in the content include UAT 7290, UAT-7290, ChronosRAT for RushDrop, MystRodX for SilentRaid, and CL-STA-0969 for related tracking by Unit 42.