Executive Summary
Since 2024, the China-linked advanced persistent threat actor UAT-9244 has been targeting telecommunication service providers in South America, compromising Windows, Linux, and network-edge devices. The group employs three previously undocumented malware families: TernDoor, a Windows backdoor; PeerTime, a Linux backdoor utilizing the BitTorrent protocol; and BruteEntry, a brute-force scanner that establishes proxy infrastructure. These tools enable UAT-9244 to maintain persistent access, execute remote commands, and expand their network infiltration.
This incident underscores the evolving sophistication of state-sponsored cyber threats targeting critical infrastructure. The use of novel malware and advanced techniques highlights the need for enhanced cybersecurity measures and vigilance within the telecommunications sector.
Why This Matters Now
The emergence of UAT-9244's advanced malware toolkit targeting South American telecoms highlights the escalating cyber threats to critical infrastructure. Organizations must prioritize robust security measures to defend against such sophisticated state-sponsored attacks.
Attack Path Analysis
UAT-9244 initiated the attack by exploiting vulnerabilities in Windows, Linux, and network-edge devices to gain initial access. They escalated privileges by deploying TernDoor and PeerTime malware, enabling deeper system control. The attackers moved laterally across the network using BruteEntry to scan and compromise additional systems. Command and control were established through PeerTime's BitTorrent-based communications, allowing remote execution of commands. Data exfiltration was conducted by transferring sensitive information through encrypted channels. The impact included persistent access, data theft, and potential disruption of telecommunications services.
Kill Chain Progression
Initial Compromise
Description
UAT-9244 exploited vulnerabilities in Windows, Linux, and network-edge devices to gain unauthorized access.
MITRE ATT&CK® Techniques
Techniques identified for SEO/filtering; may be expanded with full STIX/TAXII enrichment later.
Exploit Public-Facing Application
Command and Scripting Interpreter: Unix Shell
Create or Modify System Process: Unix Service
Encrypted Channel
Application Layer Protocol
Brute Force: Password Guessing
Remote Services: SSH
Data from Local System
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST Cybersecurity Framework (CSF) 2.0 – Identity Management and Access Control
Control ID: PR.AC-1
NIS2 Directive – Security of Network and Information Systems
Control ID: Article 21
CISA Zero Trust Maturity Model (ZTMM) 2.0 – Identity Governance
Control ID: Identity Pillar
DORA (Digital Operational Resilience Act) – ICT Risk Management Framework
Control ID: Article 5
ISO/IEC 27001:2022 – Event Logging
Control ID: A.12.4.1
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Telecommunications
Primary target of UAT-9244 APT campaign using TernDoor, PeerTime, and BruteEntry malware compromising Windows, Linux, and network-edge devices across telecom infrastructure.
Government Administration
High risk from Chinese state-sponsored attacks targeting critical infrastructure, requiring enhanced encrypted traffic monitoring and zero trust segmentation for sensitive communications.
Computer/Network Security
Direct impact from advanced malware toolkit requiring updated threat detection capabilities, egress security controls, and anomaly response systems for client protection.
Internet
Vulnerable to lateral movement and command control activities through compromised telecom infrastructure, necessitating multicloud visibility and east-west traffic security controls.
Sources
- Chinese state hackers target telcos with new malware toolkithttps://www.bleepingcomputer.com/news/security/chinese-state-hackers-target-telcos-with-new-malware-toolkit/Verified
- UAT-9244 targets South American telecommunication providers with three new malware implantshttps://blog.talosintelligence.com/uat-9244/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could have constrained the attacker's ability to exploit vulnerabilities, escalate privileges, move laterally, establish command and control, and exfiltrate data, thereby reducing the overall blast radius.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to exploit vulnerabilities in Windows, Linux, and network-edge devices would likely be constrained, limiting their initial access points.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges and gain deeper control over compromised systems would likely be constrained, reducing their operational scope.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally across the network would likely be constrained, limiting their reach to additional systems.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish command and control channels would likely be constrained, reducing their capacity for remote command execution.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate sensitive data through encrypted channels would likely be constrained, limiting data loss.
The attacker's ability to maintain persistent access, steal data, and disrupt services would likely be constrained, reducing the overall impact on telecommunications services.
Impact at a Glance
Affected Business Functions
- Network Operations
- Customer Service
- Billing Systems
- Data Management
Estimated downtime: 7 days
Estimated loss: $5,000,000
Potential exposure of customer call records, billing information, and internal network configurations.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict lateral movement and enforce least privilege access.
- • Deploy East-West Traffic Security controls to monitor and secure internal network communications.
- • Utilize Egress Security & Policy Enforcement to control outbound traffic and prevent unauthorized data exfiltration.
- • Establish Multicloud Visibility & Control to detect and respond to anomalous activities across cloud environments.
- • Apply Inline IPS (Suricata) to identify and block known exploit patterns and malicious payloads.
