China-Linked UAT-7290 Targets Telecoms with Linux Malware and ORB Nodes

A China-nexus threat actor known as UAT-7290 has been attributed to espionage-focused intrusions against entities in South Asia and Southeastern Europe, with activity since at least 2022. The group’s operations include extensive reconnaissance of target organisations before launching attacks and deploying Linux-based malware such as RushDrop, DriveSwitch, and SilentRaid, according to Cisco Talos.

They also establish Operational Relay Box (ORBs) nodes, a capability that may be used by other China-nexus actors in their operations, signalling a dual role as an espionage-motivated threat actor and an initial access group. UAT-7290 has leveraged one-day exploits and target-specific SSH brute force to compromise public-facing edge devices to gain initial access and escalate privileges, using publicly available proof-of-concept exploit code.

Notably, the threat cluster also employs Windows implants like RedLeaves and ShadowPad, while its Linux toolkit includes the backdoor Bulbature designed to transform a compromised edge device into an ORB. The researchers also link UAT-7290’s overlaps to China-linked groups such as Stone Panda and RedFoxtrot.