SOC Prime Bias: Critical

12 Jan 2026 18:32
newspaper icon Cisco Talos Blog

UAT-7290 targets high value telecommunications infrastructure in South Asia

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
UAT-7290 targets high value telecommunications infrastructure in South Asia
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

UAT-7290 is a China-linked advanced persistent threat group assessed to be active since at least 2022. It prioritizes initial access to edge networking devices and runs espionage-focused intrusions against telecommunications providers in South Asia, with more recent activity extending into Southeast Europe. The group’s toolset spans Linux implants—RushDrop, DriveSwitch, SilentRaid, and Bulbature—and Windows payloads such as RedLeaves and ShadowPad. UAT-7290 also maintains Operational Relay Box (ORB) infrastructure that can be repurposed to relay traffic for other threat actors.

Investigation

Cisco Talos analyzed relevant samples and documented a staged Linux infection chain that begins with the RushDrop dropper creating a concealed .pkgdb directory. Subsequent stages deploy DriveSwitch and then the primary implant SilentRaid. These components use DNS resolution through public resolvers to reach command-and-control and support capabilities such as command execution, file management, and reverse shell establishment. Bulbature functions as an ORB node, listening on configurable ports and using a recurring self-signed certificate that Talos noted across numerous Chinese-hosted systems.

Mitigation

Harden edge networking devices by eliminating default credentials, restricting management exposure, and rapidly patching known one-day vulnerabilities. Monitor for anomalous DNS behavior—especially unexpected queries routed to public resolvers—along with unusual BusyBox command usage and the appearance of unfamiliar binaries within hidden directories. Where applicable, deploy endpoint and network protections capable of detecting the referenced ClamAV signatures and Snort SID 65124, and ensure alerting is wired to SOC workflows.

Response

If suspicious activity is identified, isolate the affected device, capture volatile memory and disk images, and immediately block any confirmed C2 domains or IP addresses. Perform targeted forensics on the .pkgdb directory, /tmp configuration artifacts, and any evidence of spawned reverse shells. Reset compromised credentials, rotate SSH keys, and validate that no ORB nodes remain operational inside the environment.

"graph TB %% Class definitions classDef action fill:#99ccff classDef tool fill:#ffe699 classDef malware fill:#ffcccc classDef operator fill:#ff9900 %% Reconnaissance phase phase_recon["<b>Phase</b> – Reconnaissance"] class phase_recon action tech_active_scanning["<b>Technique</b> – T1595 Active Scanning<br><b>Description</b>: Identify services, versions, and configurations of target infrastructure."] class tech_active_scanning action tech_search_closed_sources["<b>Technique</b> – T1597.001 Search Closed Sources<br><b>Description</b>: Gather intelligence from vendor reports and other nonu2011public sources."] class tech_search_closed_sources action %% Initial Access phase phase_initial["<b>Phase</b> – Initial Access"] class phase_initial action tech_exploit_public_facing["<b>Technique</b> – T1190 Exploit Publicu2011Facing Application<br><b>Description</b>: Use vulnerabilities in internetu2011exposed devices to gain a foothold."] class tech_exploit_public_facing action tech_ssh_remote["<b>Technique</b> – T1021.004 Remote Services (SSH)<br><b>Description</b>: Access target devices over SSH."] class tech_ssh_remote action tech_ssh_hijack["<b>Technique</b> – T1563.001 Remote Service Session Hijacking<br><b>Description</b>: Hijack existing SSH sessions to bypass authentication."] class tech_ssh_hijack action tool_bruteforce["<b>Tool</b> – Name: SSH Bruteforce Script<br/><b>Description</b>: Attempts credential guessing on SSH services."] class tool_bruteforce tool %% Execution & Defense Evasion phase phase_exec["<b>Phase</b> – Execution & Defense Evasion"] class phase_exec action tech_vm_evasion["<b>Technique</b> – T1497 Virtualization/Sandbox Evasion<br><b>Description</b>: Detects analysis environments and modifies behavior."] class tech_vm_evasion action tech_unix_shell["<b>Technique</b> – T1059.004 Command and Scripting Interpreter: Unix Shell<br><b>Description</b>: Executes commands via /bin/sh or busybox."] class tech_unix_shell action tech_obfuscation["<b>Technique</b> – T1027 Obfuscated Files or Information<br><b>Description</b>: Uses packing or encoding to hide malicious code."] class tech_obfuscation action tech_data_obfuscation["<b>Technique</b> – T1001 Data Obfuscation<br><b>Description</b>: Alters data to avoid detection."] class tech_data_obfuscation action tech_masquerade["<b>Technique</b> – T1036.008 Masquerading: Masquerade File Type<br><b>Description</b>: Renames binaries to appear as legitimate files."] class tech_masquerade action malware_rushdrop["<b>Malware</b> – Name: RushDrop<br/><b>Description</b>: Payload delivered after exploitation, compressed with UPX."] class malware_rushdrop malware malware_driveswitch["<b>Malware</b> – Name: DriveSwitch<br/><b>Description</b>: Uses busybox for command execution."] class malware_driveswitch malware %% Privilege Escalation phase phase_priv_esc["<b>Phase</b> – Privilege Escalation"] class phase_priv_esc action tech_exploit_priv["<b>Technique</b> – T1068 Exploitation for Privilege Escalation<br><b>Description</b>: Leverages vulnerable components to gain higher rights."] class tech_exploit_priv action tech_abuse_elevation["<b>Technique</b> – T1548 Abuse Elevation Control Mechanism<br><b>Description</b>: Manipulates mechanisms that grant elevated privileges."] class tech_abuse_elevation action %% Credential Access & Discovery phase phase_cred_disc["<b>Phase</b> – Credential Access & Discovery"] class phase_cred_disc action tech_credential_dump["<b>Technique</b> – T1003.008 OS Credential Dumping<br><b>Description</b>: Reads /etc/passwd and /etc/shadow for passwords."] class tech_credential_dump action tech_system_info["<b>Technique</b> – T1082 System Information Discovery<br><b>Description</b>: Collects hostname, OS version, and hardware details."] class tech_system_info action tech_software_collect["<b>Technique</b> – T1592.002 Gather Victim Host Information: Software<br><b>Description</b>: Enumerates installed software packages."] class tech_software_collect action tech_hardware_collect["<b>Technique</b> – T1592.001 Gather Victim Host Information: Hardware<br><b>Description</b>: Retrieves CPU, memory, and device data."] class tech_hardware_collect action %% Lateral Movement phase phase_lateral["<b>Phase</b> – Lateral Movement"] class phase_lateral action tech_internal_proxy["<b>Technique</b> – T1090.001 Proxy: Internal Proxy<br><b>Description</b>: Relays traffic through compromised internal hosts."] class tech_internal_proxy action tech_external_proxy["<b>Technique</b> – T1090.002 Proxy: External Proxy<br><b>Description</b>: Uses external proxy services to hide origin."] class tech_external_proxy action tech_protocol_tunnel["<b>Technique</b> – T1572 Protocol Tunneling<br><b>Description</b>: Encapsulates traffic within allowed protocols."] class tech_protocol_tunnel action tech_nonstandard_port["<b>Technique</b> – T1571 Nonu2011Standard Port<br><b>Description</b>: Communicates over uncommon ports to evade detection."] class tech_nonstandard_port action %% Command & Control phase phase_c2["<b>Phase</b> – Command & Control"] class phase_c2 action tech_dead_drop["<b>Technique</b> – T1102.001 Web Service: Dead Drop Resolver<br><b>Description</b>: Resolves C2 domains via public DNS queries."] class tech_dead_drop action tech_one_way["<b>Technique</b> – T1102.003 Web Service: Oneu2011Way Communication<br><b>Description</b>: Sends data to C2 over DNS without receiving responses."] class tech_one_way action tech_data_encoding["<b>Technique</b> – T1132 Data Encoding<br><b>Description</b>: Encodes command results before transmission."] class tech_data_encoding action %% Connections phase_recon –>|uses| tech_active_scanning phase_recon –>|uses| tech_search_closed_sources phase_initial –>|leverages| tech_exploit_public_facing phase_initial –>|leverages| tech_ssh_remote phase_initial –>|leverages| tech_ssh_hijack phase_initial –>|uses| tool_bruteforce phase_exec –>|employs| tech_vm_evasion phase_exec –>|executes| tech_unix_shell phase_exec –>|applies| tech_obfuscation phase_exec –>|applies| tech_data_obfuscation phase_exec –>|applies| tech_masquerade phase_exec –>|delivers| malware_rushdrop phase_exec –>|delivers| malware_driveswitch phase_priv_esc –>|uses| tech_exploit_priv phase_priv_esc –>|uses| tech_abuse_elevation phase_cred_disc –>|performs| tech_credential_dump phase_cred_disc –>|performs| tech_system_info phase_cred_disc –>|performs| tech_software_collect phase_cred_disc –>|performs| tech_hardware_collect phase_lateral –>|establishes| tech_internal_proxy phase_lateral –>|establishes| tech_external_proxy phase_lateral –>|utilizes| tech_protocol_tunnel phase_lateral –>|utilizes| tech_nonstandard_port phase_c2 –>|resolves| tech_dead_drop phase_c2 –>|transmits| tech_one_way phase_c2 –>|encodes| tech_data_encoding "

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

  • Attack Narrative & Commands:

    1. Initial Dropper Execution (T1480.002):
      The attacker executes the RushDrop binary, which, as part of its payload, creates a hidden directory named .pkgdb in the current working directory.

      ./RushDrop --install .pkgdb

    2. Privileged Component Launch (T1569):
      The dropper then spawns SilentRaid with a plugins argument to load malicious modules that establish persistence via system services.

      sudo ./SilentRaid --load plugins

    3. Network Discovery (T1016.001):
      Finally, the malware collects routing information to map the internal network:

      cat /proc/net/route

    When these three command‑line fragments appear together (or the first two together and the third as an alternative), the Sigma rule condition evaluates to true, generating an alert.

  • Regression Test Script:

    #!/usr/bin/env bash
#
# UAT‑7290 detection validation script
# Simulates the exact command‑line patterns required by the Sigma rule.
#
set -euo pipefail

# 1. Create a temporary working directory
WORKDIR=$(mktemp -d)
cd "$WORKDIR"

# 2. Simulate RushDrop binary
echo -e '#!/usr/bin/env bashnecho "RushDrop executed"' > RushDrop
chmod +x RushDrop

# 3. Execute RushDrop with the .pkgdb argument (creates the folder)
./RushDrop --install .pkgdb
mkdir -p .pkgdb   # mimic dropper behavior

# 4. Simulate SilentRaid binary
echo -e '#!/usr/bin/env bashnecho "SilentRaid loaded plugins"' > SilentRaid
chmod +x SilentRaid

# 5. Execute SilentRaid with plugins argument (requires sudo for realism)
sudo ./SilentRaid --load plugins

# 6. Network discovery command
cat /proc/net/route

# 7. Clean up (optional – keep for manual inspection if needed)
# rm -rf "$WORKDIR"

  • Cleanup Commands:

    # Remove temporary directory and any artifacts created during the test
sudo rm -rf "$WORKDIR"
# Flush auditd queue to ensure no residual events remain
sudo auditctl -D
# Restart auditd to restore default rules
sudo systemctl restart auditd

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free