Uat9244 Threat Group Activity

Daniel Jeremiah@daniyyell

•updated Mar 9, 2026•0•33

This rule detects artifacts associated with the UAT-9244 threat actor, specifically targeting components of their toolset. The rule `UAT_9244_TernDoor_WSPrint_Chain` identifies strings related to the Windows backdoor chain involving WSPrint and TernDoor, including DLL names, a loader key, and device names. The rule `UAT_9244_PeerTime_Backdoor` focuses on the PeerTime Linux backdoor by looking for specific strings like 'angrypeer', 'BitTorrent', 'busybox', 'docker -q', and associated domains. The rule `UAT_9244_BruteEntry_ORB` detects markers for the BruteEntry brute-force tool, including its version string, tasking paths, and cracked agent messages. The overall purpose is to identify the core files and components used by UAT-9244 for access, lateral movement, and scanning.