Loading malware…
DriveSwitch is a Linux malware component used in the UAT-7290 intrusion set. Cisco Talos describes it as a peripheral malware/loader whose primary role is to execute the main implant, SilentRaid, on infected systems. It appears in a staged infection chain in which RushDrop, the initial dropper, performs anti-analysis checks, creates a hidden .pkgdb directory, and deploys additional components including DriveSwitch and SilentRaid. Reporting consistently places DriveSwitch in espionage-focused intrusions attributed to the China-linked threat actor UAT-7290, active since at least 2022 and targeting telecommunications providers and other critical infrastructure entities primarily in South Asia, with more recent activity in Southeastern Europe. The broader malware suite is Linux-focused and is used after initial access obtained via exploitation of public-facing edge devices and SSH brute-force activity. High-confidence malware family associations are RushDrop and SilentRaid; SilentRaid is the primary persistence implant/backdoor. No DriveSwitch-specific indicators of compromise are directly provided in the content.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The telecommunications infection chain starts with RushDrop, a dropper performing anti-analysis checks before deploying the DriveSwitch loader and SilentRaid backdoor components.
DriveSwitch, a peripheral malware that's used to execute SilentRaid on the infected system
20 distinct techniques documented for this family, organized by ATT&CK tactic.
UAT-7290 leverages one-day exploits and target-specific SSH brute force to compromise public-facing edge devices to gain initial access...
...support capabilities such as command execution... Monitor for anomalous DNS behavior... along with unusual BusyBox command usage... | These components use DNS resolution through public resolvers to reach command-and-control and support capabilities such as command execution, file management, and reverse shell establishment... any evidence of spawned reverse shells.
UAT-7290 leverages one-day exploits and target-specific SSH brute force to compromise public-facing edge devices to gain initial access...
UAT-7290 typically leverages public proof-of-concepts (PoCs) for various vulnerabilities and SSH brute force attacks to compromise public-facing devices.
UAT-7290 leverages one-day exploits and target-specific SSH brute force to compromise public-facing edge devices to gain initial access...
T1027: Obfuscated Files or Information – UAT-7290 malware obfuscation
UAT-7290 leverages one-day exploits and target-specific SSH brute force to compromise public-facing edge devices to gain initial access...
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware family referenced as being used in espionage-focused intrusions by UAT-7290.
A specialized Linux-based loader used in UAT-7290's telecommunications malware stack to help deploy or support follow-on payloads on compromised edge devices.
An intermediate Linux stage in the infection chain that is deployed after RushDrop and before SilentRaid.
Malware family used in cyber-espionage campaigns targeting telecommunications infrastructure, attributed to the UAT-7290 threat actor.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.