China-Nexus Hackers Attacking Telecommunication Providers With New Malware

Cybersecurity: UAT-9244 Campaign Targeting Telecommunications

Since 2024, an advanced persistent threat (APT) group linked to China, identified as UAT-9244, has been actively targeting telecommunications providers in South America. This group employs three new malware implants to infiltrate critical network infrastructure.

UAT-9244 targets both Windows and Linux-based endpoints, as well as network edge devices essential for managing communications. The campaign is distinguished by its systematic approach to compromising, persisting, and expanding its reach through a specialized toolkit.

TernDoor : A Windows backdoor and a variant of the CrowDoor malware. PeerTime : A Linux-based backdoor utilizing the BitTorrent protocol for communication, blending malicious traffic with regular peer-to-peer activities. BruteEntry : Converts compromised edge devices into Operational Relay Boxes (ORBs) to brute-force SSH, PostgreSQL, and Apache Tomcat servers.

These tools provide the attackers a continuously expanding foothold in targeted networks.

Cisco Talos researchers have identified UAT-9244 and found significant overlap with other known APTs, FamousSparrow and Tropic Trooper, based on shared tools and tactics. The PeerTime binary contains debug strings in Simplified Chinese, linking the campaign to Chinese-speaking threat actors.

The operation has a significant impact on the telecommunications sector. Talos researchers found a shared SSL certificate associated with 18 IP addresses likely used by UAT-9244's command-and-control infrastructure, indicating a well-resourced network.

TernDoor is deployed via DLL side-loading , using a benign Windows executable, wsprint.exe , to load a malicious file, BugSplatRc64.dll . The loader decrypts and executes shellcode in memory to evade detection.

Once active, TernDoor is injected into msiexec.exe and decodes its configuration for communication with its operators. It can execute commands, manage files, and gather system details.

TernDoor establishes persistence by creating a scheduled task named "WSPrint" and altering associated registry keys. It also sets a Registry Run key and installs a Windows driver, WSPrint.sys , which aids in process management to disable security tools.

Security teams are advised to audit scheduled tasks and Registry Run keys for unauthorized changes, monitor for DLL side-loading events, and restrict unsigned kernel driver execution. Blocking known UAT-9244 IP ranges and using ClamAV signatures, such as Win.Malware.TernDoor , Unix.Malware.BruteEntry , and Unix.Malware.PeerTime , along with SNORT rule SID 65551, is recommended to protect against this threat.

Based on reporting by Cyber Security News.