UAT-9244

UAT-9244 is a China-nexus advanced persistent threat actor disclosed by Cisco Talos and assessed with high confidence to be closely associated with FamousSparrow, with reported overlap with Tropic Trooper. Since 2024, the cluster has targeted critical telecommunications infrastructure and telecommunications providers in South America, operating across Windows systems, Linux systems, and network edge devices. Reporting attributes the campaign to three malware families: TernDoor, PeerTime, and BruteEntry. TernDoor is a Windows backdoor described as a CrowDoor/SparrowDoor-lineage implant delivered via DLL sideloading, including use of wsprint.exe and a malicious BugSplatRc64.dll loader to decrypt and execute the payload in memory, with observed injection into msiexec.exe. Reported TernDoor capabilities include remote command execution, file read/write, system information collection, persistence via a scheduled task and Registry Run key, and use of an embedded Windows driver to suspend, resume, or terminate processes. PeerTime is a Linux ELF backdoor, with C/C++ and Rust variants, compiled for multiple architectures including ARM, AArch64, MIPS, and PowerPC, and uses BitTorrent-based peer-to-peer communications to retrieve tasking and payloads. Associated tooling reportedly contains Simplified Chinese debug strings. BruteEntry is a Go-based brute-force scanner used to turn compromised edge devices into Operational Relay Boxes (ORBs) for scanning and brute-forcing SSH, PostgreSQL, and Apache Tomcat services and returning valid credentials to attacker infrastructure. The reporting states UAT-9244 is focused on maintaining persistent access to telecom environments and communications infrastructure. Cisco Talos explicitly stated it could not establish a solid connection between UAT-9244 and Salt Typhoon.