China-linked UAT-7290 spies on telco in South Asia and Europe using modular malware

China-linked UAT-7290 has conducted espionage operations since at least 2022, targeting telecom providers in South Asia and Southeastern Europe, according to Cisco Talos. The group deeply embeds in victim networks and also operates Operational Relay Box infrastructure, suggesting a dual role as both espionage actor and initial-access provider.

Its toolkit includes RushDrop, DriveSwitch, SilentRaid and Bulbature, with RushDrop acting as the dropper (also known as ChronosRAT) and SilentRaid as the main modular backdoor that communicates with a control server. Bulbature provides additional backdoor capabilities and has in recent versions used a self-signed certificate linked to infrastructure in China and Hong Kong.

The report notes that UAT-7290 overlaps in techniques and infrastructure with Red Foxtrot and with RedLeaves/ShadowPad, linking the activity to broader China-nexus operations and PLA Unit 69010.