Excerpt
Tuesday, May 5, 2026 06:00
Cisco Talos is disclosing UAT-8302, a sophisticated, China-nexus advanced persistent threat (APT) group targeting government entities in South America since at least late 2024 and government agencies in southeastern Europe in 2025.
After successful compromises, UAT-8302 deploys multiple custom-made malware families that have previously been used by other known China-nexus threat actors.
Talos discovered a .NET-based backdoor we track as “NetDraft” that is a C#-based variant of the FinalDraft/SquidDoor malware family developed and operated by Jewelbug/REF7707/CL-STA-0049/LongNosedGoblin, a cluster of China-nexus APT actors. Furthermore, UAT-8302…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Cisco Talos on blog.talosintelligence.com.
Mentioned in the excerpt
More from Cisco Talos7
- The Closed Quorum: Inside the first reported autonomous AI C2 implantCisco Talos · Published 22 Sep
- UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaignCisco Talos · Published 16 Jul
- UAT-7810 continues building ORB networks using new malwareCisco Talos · Published 7 Jul
- New Dohdoor malware campaign targets education and health careCisco Talos · Published 26 Feb
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Animal Farm APT and the Shadow of French IntelligenceInfosec Institute · Published 8 Jul 2015
- Darktrace Malware Analysis: Unpacking SnappyBeeDarktrace · Published 3 Feb
