Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…

South American telecommunication providers targeted with three new malware implants

0
Medium
Published: Thu Mar 05 2026 (03/05/2026, 20:13:36 UTC)
Source: AlienVault OTX General

Description

UAT-9244, a China-nexus advanced persistent threat actor, has been targeting critical telecommunications infrastructure in South America since 2024. The group employs three new malware implants: TernDoor, a Windows-based backdoor variant of CrowDoor; PeerTime, an ELF-based backdoor using BitTorrent protocol; and BruteEntry, a brute force scanner for SSH, Postgres, and Tomcat servers. UAT-9244 uses dynamic-link library side-loading, scheduled tasks, and registry modifications for persistence. The group is closely associated with FamousSparrow and Tropic Trooper, sharing similar tooling and tactics. Their infrastructure includes multiple command and control servers and operational relay boxes for scanning and brute-forcing activities.

AI-Powered Analysis

AILast updated: 03/06/2026, 11:45:48 UTC

Technical Analysis

UAT-9244 is an advanced persistent threat actor with a China nexus that has been actively targeting telecommunications providers in South America since 2024. The group deploys three novel malware implants: TernDoor, a Windows backdoor derived from CrowDoor that enables stealthy remote access; PeerTime, an ELF-based backdoor that uniquely uses the BitTorrent protocol for command and control communications, complicating detection and blocking efforts; and BruteEntry, a brute force scanning tool designed to identify and exploit weak credentials on SSH, Postgres, and Tomcat servers. Persistence is maintained through dynamic-link library (DLL) side-loading, scheduled task creation (T1053.005), and registry modifications, allowing the malware to survive reboots and evade simple detection. The group’s operational infrastructure includes multiple command and control servers and relay boxes that facilitate scanning and brute forcing activities. UAT-9244 shares significant overlap in tooling and tactics with other Chinese APT groups such as FamousSparrow and Tropic Trooper, indicating a possible shared development or coordination. The use of BitTorrent for C2 is notable as it leverages a decentralized protocol to evade network-based detection and takedown. The threat targets critical telecommunications infrastructure, which is vital for national communications and internet services, making the attacks strategically significant. Despite the lack of publicly known exploits in the wild, the sophistication and targeted nature of the implants suggest a well-resourced and persistent adversary focused on espionage or disruption. The malware’s capabilities to brute force credentials and maintain stealthy persistence increase the risk of prolonged undetected access and potential data exfiltration or service disruption.

Potential Impact

The targeting of critical telecommunications infrastructure by UAT-9244 poses significant risks to the confidentiality, integrity, and availability of communications services in South America. Successful compromise could lead to unauthorized access to sensitive communications data, interception or manipulation of network traffic, and potential disruption of telecom services affecting millions of users. The use of brute force scanning tools increases the likelihood of lateral movement and escalation within networks, potentially compromising additional critical systems. The stealthy persistence mechanisms and use of decentralized BitTorrent protocol for command and control complicate detection and response efforts, allowing the adversary to maintain long-term access. This could facilitate espionage activities, data theft, or preparation for future disruptive attacks. The impact extends beyond individual providers to national security, economic stability, and public safety, given the essential role of telecommunications in modern society. Organizations may face operational disruptions, reputational damage, regulatory penalties, and increased incident response costs. The medium severity rating reflects the targeted scope and complexity of the threat, balanced against the absence of widespread exploitation reports to date.

Mitigation Recommendations

Organizations should implement multi-layered defenses tailored to the specific tactics and tools used by UAT-9244. Key mitigations include: 1) Enforce strong credential policies and multi-factor authentication on all SSH, Postgres, and Tomcat services to mitigate brute force attacks by BruteEntry. 2) Monitor for unusual DLL loading behaviors and scheduled task creations indicative of DLL side-loading and persistence mechanisms. 3) Deploy network monitoring to detect anomalous BitTorrent protocol usage within enterprise networks, as PeerTime uses this for C2 communications. 4) Conduct regular vulnerability assessments and patch management to reduce attack surface, especially on exposed services. 5) Implement endpoint detection and response (EDR) solutions capable of identifying backdoor implants and lateral movement techniques. 6) Use threat intelligence feeds to update detection signatures and indicators related to UAT-9244 and associated malware. 7) Segment critical telecom infrastructure networks to limit lateral movement opportunities. 8) Conduct regular security awareness training focused on recognizing signs of compromise and social engineering attempts. 9) Establish incident response plans specifically addressing APT-style intrusions with coordinated cross-team communication. 10) Collaborate with regional cybersecurity organizations and law enforcement to share intelligence and coordinate defense efforts. These measures go beyond generic advice by focusing on the unique aspects of UAT-9244’s malware implants, persistence techniques, and C2 methods.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Author
AlienVault
Tlp
white
References
["https://blog.talosintelligence.com/uat-9244/"]
Adversary
UAT-9244
Pulse Id
69a9e3f038f67d31461ec191
Threat Score
null

Indicators of Compromise

Ip

ValueDescriptionCopy
ip154.205.154.194
ip154.205.154.65
ip154.205.154.70
ip154.205.154.82
ip154.223.21.130
ip154.223.21.194
ip185.196.10.247
ip185.196.10.38
ip212.11.64.105
ip38.54.125.134
ip38.60.199.34
ip64.190.113.170
ip64.95.10.253

Hash

ValueDescriptionCopy
hash02b804b02aac1ab4cfc8e88dbcb5ee96
hash05580309235fa04c22cf6cbd31ef39ce
hash12ad67761f785db7405de3c0ea76ff09
hash236c79305336f4dddbe25eb24f5cbd1a
hash24f2be6bd956c54db1b93c4c97fdb431
hash3a4ccd2ef01f6956decba1038669cbbe
hash6cf3ed386024c73e6666416437f2e6a7
hashe0ab78a2f5b92d265437fc9dd86e2899
hashe0c13dcf6ee7065400c7617bba781d75
hashe75df6e03fc11fa8bd75351b0d5bce6c
hashfbf96d77f4cc47d9b583313649653377
hashff3a1b28267dd826d4e1c46c6f54bd55
hash01b9161375f2f20c8058357106d2a51004f9d4aa
hash2b170a6d90fceba72aba3c7bc5c40b9725f43788
hash30a30487b0d3597f6290e7e9d4098f4991c18fde
hash50ac201eaeef516f132ea2067bb774d0d1d86edb
hash6be1782ea400c8cfbba20ab633cc5793c04d1f09
hash755c55ecc9896f5db71becb32261ccfe318fd626
hash8d8a870397ce8d8612c996ab112e9d7af6333c82
hasha749e6bf064cfae46752da40376f5851a0bb691e
hashbd1ef371ab4af20ba46e72dbb67856918a908838
hashbdf4237546ed6020076a8ee264982ad3375b1ec5
hashf02f7dabac0cf876fcac48c46df0e58ad452615e
hashf19f96e59e8f62a34eb305012db0b85d40ed81c6
hashfb49fa003a94a176d0f16b66a40691fb3215d732
hash00735a8a50d2856c11150ef1e29c05acebce7ad3edad00e37c7f043aacb46330
hash023467e236a95d5f0e62e26445d430d749c59312f66cf136e6e2c2d526c46ba1
hash03eac9eb7f4b4bc494ef0496ee23cabbf38f883896838ed813741d8f64ac9fde
hash06b23d84fd7afd525dfd7860ebd561dcdd72ccbeb51981d5d9a75acf068d0a2a
hash075b20a21ea6a0d2201a12a049f332ecc61348fc0ad3cfee038c6ad6aa44e744
hash0c7e36683a100a96f695a952cf07052af9a47f5898e1078311fd58c5fdbdecc8
hash15d937803f90c2b9e277ff94d3e98ff30015ecc7f4623a158e3c98861e5cb278
hash17652d7bb5fe0454023db4fc7f608df0dbe6af237be31258e16ba52f0e895e26
hash1cedf01dd4b7e50181d0e781825c66957b862941395d77c8bd7705114f319c80
hash1f5635a512a923e98a90cdc1b2fb988a2da78706e07e419dae9e1a54dd4d682b
hash1fcdd5a417db31e5e07d32cecfa69e53f0dce95b7130ad9c03b92249f001801d
hash2c3f2261b00ea45e25eb4e9de2b7ff8e41f311c0b3d986461f834022c08b3b99
hash2d2ca7d21310b14f5f5641bbf4a9ff4c3e566b1fbbd370034c6844cedc8f0538
hash34d64b3cd9430e85edefcb883973a086dd5de9917e05fabec89b1f4ab9627e91
hash38eeaa4eaad72feb3f8e6993565fcc548d8e7bb93642590f00fa24aacc0e2862
hash3c098a687947938e36ab34b9f09a11ebd82d50089cbfe6e237d810faa729f8ff
hash3d9fbfc2c056eac857ba54e5ed134aa45a4b8322ee9f9353ba32e5b2ca71b0e3
hash3fcadde4b414a18b2fed56c1ec59d97977123615fbbf411a1c78425445a6e71c
hash3fcced9332301ff70b20c98c9434c858400013d659afa6bb5149cffb0206357d
hash56bead2933e91366e4a0d5761daf5b238a7f2c22e597664ef67b3ecae20ab326
hash66adeedfb739774fcc09aa7426c8fad29f8047ab4caee8040d07c0e84d011611
hash66bdce93de3b02cf9cdadad18ca1504ac83e379a752d51f60deae6dcbafe4e31
hash66ce42258062e902bd7f9e90ad5453a901cfc424f0ea497c4d14f063f3acd329
hash6a2d23cc8746a83e9a3b974788fce0e414706b8e75ff390426dd7e10b19967b3
hash6ec070457d1f6f239cb02c5e1576a3660cca98f3a07eec6e4e107f698d7fe555
hash711d9427ee43bc2186b9124f31cba2db5f54ec9a0d56dc2948e1a4377bada289
hash74d1a678bdc4bb9f33321e94e3bd1bc1740472ed734231fc46af720072ecb77e
hash74fbc8360d4c95d64d7acaa4d18943dce2d41f91d080b0b5e435d8bce52861a5
hash7b70cd956f082b1029d02b4cb7608893f2de7fa9c500d7d7febdd0f745ac3cb6
hash870e791af14caaf395c56028176a9c3f4c1ff0318ef3112d57ecd3d4a1be2ef9
hash9a7225c17e4bad3ffe7f080530d36f4f8aca5c116b913caa91ab9b0cee85638e
hasha313f76fca50fff1bcd6f2c6cbc1268985f8c0a3a05fe7f43c4fc0ac3aff84dc
hasha5e413456ce9fc60bb44d442b72546e9e4118a61894fbe4b5c56e4dfad6055e3
hashbabc81fc9c998e9dc4ab545f0e112e34d2641e1333bc81aaa131abd061a5b604
hashbfc35f12d00fa4b40c5fbce9e37d704e12a52262709bcbdf09f97890bc40cad5
hashc9a42423ef08bd7f183915780d39530eba5e4e25968c51965ff8bb3026965a28
hashc9fc2af30f769d856b88b3051f19fdb663b3e0a0916279df9bbcba93c6a110c9
hashd5eb979cb8a72706bfa591fa57d4ebf7d13cecdc9377b0192375e2f570f796df
hashd78b3c6df8f3756a7e310cf7435fdba201dd03ec9f97420a0db683489a01a7c9
hashe34c9159e6e78c59518a14c5b96bddfee094b684f99d4f69b13371284a014e87
hashebcb2691b7c92cdf2b2ff5e2d753abeea8cb325c16596cd839e6bd147f80e38a
hashf36913607356a32ea106103387105c635fa923f8ed98ad0194b66ec79e379a02
hashf3e899789b56429f483e5096e1f473335024f1f763e2d428132338e30352b89e
hashf8066833e47814793d8c58743622b051070dac09cb010c323970c81b59260f84

Domain

ValueDescriptionCopy
domainbloopencil.net
domainxcit76.com
domainxtibh.com

Threat ID: 69aabacfc48b3f10ff55379c

Added to database: 3/6/2026, 11:30:23 AM

Last enriched: 3/6/2026, 11:45:48 AM

Last updated: 3/7/2026, 9:24:57 AM

Views: 31

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

External Links

Need more coverage?

Upgrade to Pro Console in Console -> Billing for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses