Targets high value telecommunications infrastructure in South Asia

UAT-7290, a sophisticated threat actor active since 2022, is targeting critical infrastructure entities in South Asia, particularly telecommunications providers. The group's arsenal includes malware families like RushDrop, DriveSwitch, SilentRaid, and Bulbature. UAT-7290 conducts extensive reconnaissance before intrusions, using one-day exploits and SSH brute force to compromise edge devices. The actor is believed to be a China-nexus APT, sharing similarities with APT10 and other known Chinese threat groups. UAT-7290 has recently expanded its targeting to Southeastern Europe and may establish Operational Relay Boxes for other China-nexus actors. Their malware suite primarily focuses on Linux systems but can also utilize Windows-based implants.

• One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law EnforcementMalware2026-07-09
• India's government and energy sectors targeted with ZOHOMURK and MINIRECONMalware2026-06-29
• Melofee: a look back at a Linux implant and its new variantsMalware2026-09-10
• SilkParasite: Tracking a China-Nexus APT Across Central AsiaMalware2026-08-20
• Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy CirclesCampaign2026-10-01