UAT-8302
UAT-8302 is a sophisticated China-nexus advanced persistent threat group tracked by Cisco Talos. Talos reported that the group has targeted government entities in South America since at least late 2024 and government agencies in southeastern Europe in 2025. Talos assessed with high confidence that UAT-8302 is tasked primarily with gaining and maintaining long-term access to government and related entities worldwide. Observed post-compromise activity includes deep reconnaissance, credential collection, Active Directory enumeration, lateral movement, proxying, and persistence. Reported tooling includes custom malware and open-source utilities such as Impacket, gogo, QScan, naabu, dddd, httpx, PortQry, adconnectdump.py, AD Explorer, SharpGetUserLoginRDP/SharpGetUserLoginIPRP, MobaXtermDecryptor, Stowaway, anyproxy, and SoftEther VPN. Malware associated with UAT-8302 includes NetDraft, CloudSorcerer v3, VSHELL, SNOWLIGHT, SNOWRUST, SNAPPYBEE/DeedRAT, ZingDoor, and Draculoader. NetDraft is a .NET backdoor delivered via DLL side-loading and communicates through the Microsoft Graph API with a OneDrive-based command-and-control channel; Talos links it to the FinalDraft/SquidDoor family and notes ESET tracks related activity as NosyDoor used by LongNosedGoblin. CloudSorcerer v3 was observed using named pipes or retrieving command-and-control information from GitHub depending on the host process. SNOWRUST is a Rust-based variant of the SNOWLIGHT stager used to download and execute VSHELL. In at least one intrusion, UAT-8302 deployed SNAPPYBEE together with ZingDoor. Cisco Talos assessed with high confidence that UAT-8302 shares tooling with previously disclosed China-nexus clusters and indicated a close operational relationship with LongNosedGoblin. The reporting also notes tooling overlap with activity associated with Jewelbug/REF7707/CL-STA-0049, Earth Estries, Earth Naga, UNC5174, UNC6586, and UAT-6382. The exact initial access vector is not known; Talos suspects exploitation of zero-day and N-day vulnerabilities in web applications. Known aliases and related names mentioned in the reporting include UAT-8302, NetDraft/NosyDoor, SNAPPYBEE/DeedRAT, and FinalDraft/SquidDoor.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
33 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
16 malware families attributed to this actor across reporting.
11 additional families tracked in Mallory.
Observables
45 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
China-nexus espionage group conducting long-term intrusions against government and related entities, especially in South America and southeastern Europe, using custom malware, open-source tools, credential harvesting, reconnaissance, persistence tooling, and stealthy cloud-based command-and-control.
China-nexus espionage activity targeting government organizations, using shared/custom malware and post-exploitation tooling associated with other China-aligned clusters.
China-nexus espionage group focused on obtaining and maintaining long-term access to government and related entities worldwide. It conducts reconnaissance, credential extraction, lateral movement/proliferation, and deploys multiple custom malware families including NetDraft, CloudSorcerer v3, VSHELL, SNOWLIGHT, SNOWRUST, DeedRAT/SNAPPYBEE, ZingDoor, and Draculoader.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.