UAT-9244

UAT-9244 is a China-nexus advanced persistent threat cluster engaged in cyberespionage against telecommunications infrastructure in South America since at least 2024. The activity is assessed to overlap closely with FamousSparrow and to share overlap with Tropic Trooper. Reporting has also linked related FamousSparrow activity to an intrusion against an Azerbaijani oil and gas company, indicating broader espionage victimology beyond telecom, but the strongest direct attribution for UAT-9244 centers on South American telecom providers. The cluster operates across Windows, Linux, and network edge environments and has used three notable malware families: TernDoor, PeerTime, and BruteEntry. TernDoor is a Windows backdoor in the CrowDoor/SparrowDoor lineage that has been delivered through DLL sideloading, executed in memory, and injected into legitimate processes. It supports remote command execution, file operations, system information gathering, persistence through scheduled tasks, services, and Run-key mechanisms, and includes a malicious driver used to suspend, resume, or terminate processes. PeerTime is a multi-architecture Linux backdoor, including variants for ARM, AArch64, MIPS, and PowerPC, enabling compromises of servers, routers, embedded appliances, and other telecom-supporting infrastructure. It uses BitTorrent-style peer-to-peer communications for tasking and payload retrieval, can disguise process names, and has shown awareness of containerized environments. BruteEntry is a Go-based brute-force and scanning utility used to convert compromised edge devices into Operational Relay Boxes that support scanning, credential attacks, relay activity, and follow-on access expansion. Observed tradecraft includes exploitation of exposed or unpatched internet-facing services, use of weak credentials, web-shell deployment in related FamousSparrow-linked operations, DLL sideloading, in-memory execution, process injection, persistence via scheduled tasks and services, registry-based persistence, anti-analysis measures, and use of peer-to-peer communications to reduce dependence on centralized command infrastructure. BruteEntry has been used to target exposed SSH, PostgreSQL, and Apache Tomcat services, while compromised Linux systems have been repurposed for scanning, brute-force activity, lateral movement support, and covert relay operations. The actor's targeting of critical communications infrastructure, emphasis on durable access, and tooling choices are consistent with long-term intelligence collection rather than disruptive or destructive operations. Available evidence supports espionage as the dominant motivation.