China-Nexus Actor UAT-7290 Caught Targeting Telecoms in South Asia and Europe

Cisco Talos has pulled back the curtain on UAT-7290, a threat actor operating out of the China-nexus since at least 2022. Specialising in stealth and persistence, the group has been systematically dismantling the networks of critical infrastructure entities, with a particular focus on telecommunications providers in South Asia and more recently Southeastern Europe.

According to Cisco Talos, UAT-7290 plays a dual role: conducting deep-cover espionage and establishing Operational Relay Box (ORB) infrastructure that other hackers can use to route their attacks. The researchers note that the group deploys a custom-built arsenal to infiltrate, persist and exfiltrate without detection, identifying three implants—RushDrop, DriveSwitch and SilentRaid—alongside a backdoor known as Bulbature designed to obtain additional or new C2 addresses and switch communications if needed.

They also highlight extensive technical reconnaissance of target organisations before intrusions. While their primary hunting ground has been South Asian telecoms, the report indicates UAT-7290 has expanded targeting into Southeastern Europe in recent months, making them a versatile threat actor within the China-nexus.