Loading threat actor…
UAT-8302 is a China-nexus advanced persistent threat group focused on compromising government and related entities to obtain and maintain long-term access. The group has been observed targeting government organizations in South America since at least late 2024 and government agencies in southeastern Europe in 2025. Its operations are characterized by extensive post-compromise reconnaissance, credential harvesting, Active Directory enumeration, lateral movement, and the establishment of redundant access channels for persistence and follow-on exploitation. UAT-8302 uses a mix of custom malware, open-source tooling, and legitimate cloud and internet services to blend malicious traffic with normal activity. Malware and tooling associated with the group include NetDraft, also known as NosyDoor and linked to the FinalDraft or SquidDoor family; CloudSorcerer v3; VSHELL delivered via the SNOWLIGHT stager and the Rust-based SNOWRUST variant; SNAPPYBEE, also known as DeedRAT; ZingDoor; Draculoader; Stowaway; and SoftEther VPN. NetDraft has been delivered through DLL side-loading and has used Microsoft Graph API communications with a OneDrive-based command channel. CloudSorcerer v3 has been observed using process injection and retrieving command information through legitimate online platforms, including GitHub, as well as cloud-storage-backed channels. The group’s tradecraft includes internal scanning, host and network discovery, credential collection from enterprise and remote-access tooling, user-session collection, and proxy or tunneling mechanisms to preserve access. UAT-8302 has used Impacket, PowerShell-based reconnaissance, network scanning utilities, Active Directory collection tools, and credential-harvesting utilities during intrusions. Researchers have assessed with high confidence that UAT-8302 shares tooling and operational overlap with other China-nexus or Chinese-speaking clusters, particularly LongNosedGoblin, and also exhibits malware and tradecraft connections to activity tracked as Earth Estries, Earth Naga, UNC5174, UNC6586, UAT-6382, Jewelbug, REF7707, and CL-STA-0049. The exact initial access vector is not confirmed, though suspected methods include exploitation of web-application vulnerabilities. The actor’s overall profile is consistent with state-aligned cyber espionage focused on persistent access to government networks.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
33 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
16 malware families attributed to this actor across reporting.
11 additional families tracked in Mallory.
45 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
China-nexus espionage group conducting long-term intrusions against government and related entities, especially in South America and southeastern Europe, using custom malware, open-source tools, credential harvesting, reconnaissance, persistence tooling, and stealthy cloud-based command-and-control.
China-nexus espionage activity targeting government organizations, using shared/custom malware and post-exploitation tooling associated with other China-aligned clusters.
China-nexus espionage group focused on obtaining and maintaining long-term access to government and related entities worldwide. It conducts reconnaissance, credential extraction, lateral movement/proliferation, and deploys multiple custom malware families including NetDraft, CloudSorcerer v3, VSHELL, SNOWLIGHT, SNOWRUST, DeedRAT/SNAPPYBEE, ZingDoor, and Draculoader.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.