Loading threat actor…
UAT-7290 is a China-linked advanced persistent threat actor active since at least 2022 that conducts cyber-espionage and initial-access operations. The group primarily targets telecommunications providers and other critical infrastructure entities in South Asia, with more recent activity extending into Southeastern Europe. Reporting consistently characterizes the actor as part of the broader China-nexus intrusion ecosystem and notes overlaps in tooling, infrastructure, and victimology with other China-aligned clusters, including activity associated with RedLeaves, ShadowPad, and Red Foxtrot. Palo Alto Networks Unit 42 has tracked related activity as CL-STA-0969, and other reporting has noted overlaps with Stone Panda and Red Foxtrot. Claims that UAT-7290 is a splinter unit of APT41 are not sufficiently corroborated and should be treated as unconfirmed. UAT-7290 specializes in compromising public-facing edge networking devices. Its intrusion workflow includes extensive technical reconnaissance, exploitation of known and one-day vulnerabilities using publicly available proof-of-concept code, and SSH brute-force activity against exposed systems. The actor appears to favor Linux-heavy environments common in telecommunications infrastructure and deploys a modular malware set that includes RushDrop, DriveSwitch, SilentRaid, and Bulbature. RushDrop functions as a dropper and performs anti-analysis checks before staging additional components. DriveSwitch is used to execute the primary implant. SilentRaid, also known as MystRodX, is the main persistence implant and supports remote command execution, reverse shell access, file management, port forwarding, and related post-compromise control functions. Bulbature is used to convert compromised devices into Operational Relay Boxes, enabling relay and proxy infrastructure that can support follow-on operations. A notable aspect of UAT-7290 is its apparent dual role. In addition to conducting deep espionage intrusions inside victim networks, the actor establishes Operational Relay Box infrastructure on compromised systems that may later be reused by other China-nexus operators. This suggests UAT-7290 functions both as an espionage actor and as an initial-access or infrastructure-enablement group within a broader ecosystem. The actor has also been associated with occasional use of Windows implants such as RedLeaves and ShadowPad, but its core tradecraft is centered on Linux-based edge-device compromise, persistence, and covert relay enablement. The group’s dominant motivation is espionage, with operations focused on long-term access to strategically significant telecommunications and critical infrastructure networks rather than financially motivated disruption or extortion.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
55 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
6 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A splinter unit associated with APT 41 that reportedly maintained covert access in North American developer environments for over a year while observing and preparing for native-looking follow-on activity.
China-linked activity cluster associated with access acquisition and espionage operations (details not expanded in the provided content).
China-nexus threat actor conducting espionage-focused intrusions against entities in South Asia and Southeastern Europe.
Conducting sustained cyber-espionage operations against telecommunications infrastructure, extracting sensitive network intelligence, and converting compromised telecom systems into covert relay nodes supporting broader state-aligned operations.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.