UAT-8302 Targeting Government Entities with Custom Malware

Cisco Talos has identified a sophisticated China-nexus APT group, tracked as UAT-8302, which has been targeting government organizations in South America and southeastern Europe since late 2024. The group demonstrates high operational coordination with other known Chinese threat clusters, such as Earth Estries, UNC5174, and Jewelbug, by sharing infrastructure and custom-developed malware families.

The attack chain involves the exploitation of vulnerabilities followed by extensive reconnaissance using both open-source and custom tools like 'whatpc.ps1'. UAT-8302 maintains persistence through sophisticated DLL side-loading techniques and the deployment of modular backdoors like NetDraft (a .NET variant of SquidDoor) and CloudSorcerer v3, which leverage legitimate cloud services like GitHub, MS Graph, and OneDrive for C2 communication.

This activity underscores a broader trend of tool-sharing among Chinese-speaking APTs, complicating attribution and defensive efforts. The group's focus on government agencies for long-term intelligence collection poses a significant risk to national security and diplomatic data integrity in the affected regions.