Modern cyber-espionage campaigns increasingly target telecommunications infrastructure because it provides strategic visibility into communications, metadata, and network traffic. Recently, Cisco Talos disclosed a new advanced persistent threat (APT) cluster tracked as UAT-9244, which has been actively targeting telecom providers in South America since at least 2024.
The campaign demonstrates a mature intrusion toolkit featuring multiple malware implants designed for Windows endpoints, Linux systems, and embedded edge devices. The threat actor’s operations rely on three primary components:
- TernDoor – a Windows backdoor derived from CrowDoor
- PeerTime – a peer-to-peer ELF backdoor leveraging BitTorrent
- BruteEntry – a brute-force scanning tool used to create distributed proxy nodes
This combination enables attackers to maintain persistent access, move laterally, and build infrastructure for additional compromises.
Threat Actor Profile
Cisco Talos assesses with high confidence that UAT-9244 is a China-nexus APT group closely associated with the Famous Sparrow threat cluster.
Several factors support this attribution:
- Overlap in tooling with CrowDoor/SparrowDoor malware families
- Similar tactics, techniques, and procedures (TTPs)
- Targeting patterns consistent with cyber-espionage operations
- Infrastructure and malware artifacts linked to previously observed Chinese APT campaigns
The group focuses on telecommunications infrastructure, which is a high-value espionage target due to its role in communications and network routing.
Attack Chain Overview
The intrusion chain deployed by UAT-9244 includes multiple stages designed for stealth, persistence, and operational flexibility.
Typical attack workflow:
- Initial compromise of telecom infrastructure.
- Deployment of a loader through DLL side-loading techniques.
- Activation of the TernDoor backdoor on Windows systems.
- Deployment of PeerTime malware on Linux and embedded devices.
- Installation of BruteEntry scanning nodes on compromised infrastructure.
- Use of infected systems as Operational Relay Boxes (ORBs) to facilitate further attacks.
This layered approach allows the attacker to maintain long-term access while also expanding their operational infrastructure.
TernDoor: A CrowDoor Variant for Windows
The primary Windows implant used in this campaign is TernDoor, a backdoor derived from the previously observed CrowDoor malware family.
Execution Mechanism
The malware uses DLL side-loading to initiate execution:
- A legitimate executable (
wsprint.exe) loads a malicious DLL (BugSplatRc64.dll). - The DLL reads an encoded payload (
WSPrint.dll). - The payload is decrypted and executed in memory.
- The final stage loads the TernDoor backdoor.
This technique allows the attacker to hide malicious execution behind legitimate applications.
Persistence
TernDoor maintains persistence through:
- Scheduled tasks
- Windows Registry Run keys
Example persistence mechanism:
schtasks /create /tn WSPrint /tr "C:\ProgramData\WSPrint\WSPrint.exe" /ru SYSTEM /sc onstart
The malware also manipulates registry keys to hide scheduled tasks and evade detection.
Capabilities
TernDoor supports several post-compromise capabilities:
- Command-and-control (C2) communication
- Remote command execution
- File read/write operations
- System information collection
- Process management via kernel driver
- Self-removal functionality
An embedded Windows driver enables process termination and suspension, providing additional stealth and defense evasion capabilities.
PeerTime: Peer-to-Peer Backdoor for Linux and Embedded Devices
While TernDoor targets Windows systems, UAT-9244 also deploys PeerTime, an ELF-based backdoor designed for Linux and embedded environments.
The malware supports multiple architectures including:
- ARM
- MIPS
- PPC
- AARCH
This indicates targeting of network appliances and telecom edge devices.
Peer-to-Peer Communication
Unlike traditional malware using centralized C2 servers, PeerTime uses the BitTorrent protocol for command-and-control communication.
Capabilities include:
- Retrieving configuration and C2 data from peers
- Downloading additional payloads
- Executing commands on infected hosts
The malware also renames its process to mimic legitimate applications, improving its ability to evade detection.
BruteEntry: Building Operational Relay Boxes (ORBs)
The third component of the campaign is BruteEntry, a brute-force scanning tool deployed on compromised Linux systems.
The malware transforms infected hosts into Operational Relay Boxes (ORBs)—essentially distributed proxy nodes used for scanning and further attacks.
Targeted Services
BruteEntry attempts to brute-force authentication for:
- SSH
- PostgreSQL
- Apache Tomcat
The malware receives target IP addresses and tasks from a command-and-control server.
Typical workflow:
- Host registers with C2 server.
- Receives scanning tasks.
- Attempts authentication using embedded credentials.
- Reports successful compromises back to the C2 infrastructure.
This infrastructure enables the attacker to expand their attack surface without exposing their own systems.
Strategic Objective: Telecom Espionage
Telecommunication providers are prime targets for nation-state actors because they offer access to:
- Call metadata
- Network traffic patterns
- Communication routing infrastructure
- Government and enterprise communications
Compromising telecom infrastructure allows attackers to conduct large-scale surveillance and intelligence gathering.
UAT-9244’s focus on telecom providers in South America suggests a strategic effort to establish long-term access to regional communication networks.
Detection and Mitigation
Security teams can mitigate threats associated with this campaign by implementing several defensive measures:
Network Monitoring
Monitor for suspicious traffic related to:
- Peer-to-peer BitTorrent-based communications
- Unusual outbound connections from telecom infrastructure
Endpoint Security
Deploy detection rules capable of identifying:
- DLL side-loading attacks
- Unknown scheduled tasks
- Suspicious drivers and kernel modules
Infrastructure Hardening
Organizations should:
- Patch exposed edge devices
- Restrict SSH access
- Enforce strong authentication mechanisms
- Monitor brute-force login attempts
Talos has released Snort and ClamAV signatures capable of detecting the associated malware families.
Final Thoughts
The UAT-9244 campaign highlights a broader trend in modern cyber-espionage: targeting network infrastructure rather than individual endpoints.
By combining multiple malware implants across operating systems and leveraging compromised infrastructure as scanning nodes, the attackers create a distributed and resilient attack ecosystem.
Telecommunications providers, in particular, remain high-value targets for state-aligned actors seeking strategic intelligence access. As campaigns like UAT-9244 continue to evolve, defenders must adopt infrastructure-level monitoring and cross-platform threat detection to effectively counter these threats.
