DriveSwitch
DriveSwitch is a Linux malware component used in the UAT-7290 intrusion set. Cisco Talos describes it as a peripheral malware/loader whose primary role is to execute the main implant, SilentRaid, on infected systems. It appears in a staged infection chain in which RushDrop, the initial dropper, performs anti-analysis checks, creates a hidden .pkgdb directory, and deploys additional components including DriveSwitch and SilentRaid. Reporting consistently places DriveSwitch in espionage-focused intrusions attributed to the China-linked threat actor UAT-7290, active since at least 2022 and targeting telecommunications providers and other critical infrastructure entities primarily in South Asia, with more recent activity in Southeastern Europe. The broader malware suite is Linux-focused and is used after initial access obtained via exploitation of public-facing edge devices and SSH brute-force activity. High-confidence malware family associations are RushDrop and SilentRaid; SilentRaid is the primary persistence implant/backdoor. No DriveSwitch-specific indicators of compromise are directly provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The telecommunications infection chain starts with RushDrop, a dropper performing anti-analysis checks before deploying the DriveSwitch loader and SilentRaid backdoor components.
DriveSwitch, a peripheral malware that's used to execute SilentRaid on the infected system
Techniques & procedures
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
2 techniquesT1587: Develop Capabilities – UAT-7290 custom telecommunications malware development
Once inside, they deploy a diverse arsenal of tools, including custom Linux malware variants such as RushDrop, DriveSwitch, and SilentRaid (the primary implant for persistence).
Initial Access
3 techniquesUAT-7290 leverages one-day exploits and target-specific SSH brute force to compromise public-facing edge devices to gain initial access...
UAT-7290 typically leverages public proof-of-concepts (PoCs) for various vulnerabilities and SSH brute force attacks to compromise public-facing devices.
It prioritizes initial access to edge networking devices... Mitigation Harden edge networking devices by eliminating default credentials, restricting management exposure, and rapidly patching known one-day vulnerabilities.
Execution
1 technique...support capabilities such as command execution... Monitor for anomalous DNS behavior... along with unusual BusyBox command usage... | These components use DNS resolution through public resolvers to reach command-and-control and support capabilities such as command execution, file management, and reverse shell establishment... any evidence of spawned reverse shells.
Persistence
4 techniquesUAT-7290 leverages one-day exploits and target-specific SSH brute force to compromise public-facing edge devices to gain initial access...
UAT-7290 typically leverages public proof-of-concepts (PoCs) for various vulnerabilities and SSH brute force attacks to compromise public-facing devices.
T1543: Create or Modify System Process – Telecommunications system persistence establishment
Privilege Escalation
3 techniquesUAT-7290 leverages one-day exploits and target-specific SSH brute force to compromise public-facing edge devices to gain initial access...
T1543: Create or Modify System Process – Telecommunications system persistence establishment
Stealth
7 techniquesT1027: Obfuscated Files or Information – UAT-7290 malware obfuscation
T1027.002: Software Packing – Packed telecommunications malware
“…deploy three components… and a legitimate BusyBox utility.”
UAT-7290 leverages one-day exploits and target-specific SSH brute force to compromise public-facing edge devices to gain initial access...
T1140: Deobfuscate/Decode Files or Information – Runtime malware unpacking
T1564: Hide Artifacts – Concealment of telecommunications compromise
T1564.001: Hidden Files and Directories – Hidden malware on telecommunications devices
Credential Access
2 techniquesUAT-7290 typically leverages public proof-of-concepts (PoCs) for various vulnerabilities and SSH brute force attacks to compromise public-facing devices.
“...and target-specific SSH brute force to compromise public-facing edge devices to gain initial access...”
Discovery
1 techniqueThese components use DNS resolution through public resolvers to reach command-and-control and support capabilities such as command execution, file management...
Lateral Movement
1 techniqueUAT-7290 typically leverages public proof-of-concepts (PoCs) for various vulnerabilities and SSH brute force attacks to compromise public-facing devices.
Command and Control
2 techniquesThese components use DNS resolution through public resolvers to reach command-and-control...
RushDrop then decodes and drops three binaries to the “.pkgdb” folder: “daytime” ... tracked as DriveSwitch. “chargen” ... tracked as SilentRaid. “busybox” - Busybox is a legitimate Linux utility that can be used to execute arbitrary commands on the system.
IOCs tracked for this family
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware family referenced as being used in espionage-focused intrusions by UAT-7290.
A specialized Linux-based loader used in UAT-7290's telecommunications malware stack to help deploy or support follow-on payloads on compromised edge devices.
An intermediate Linux stage in the infection chain that is deployed after RushDrop and before SilentRaid.
Malware family used in cyber-espionage campaigns targeting telecommunications infrastructure, attributed to the UAT-7290 threat actor.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.