UAT-7290 is a China-linked advanced persistent threat group assessed to be active since at least 2022. It prioritizes initial access to edge networking devices and runs espionage-focused intrusions against telecommunications providers in South Asia, with more recent activity extending into Southeast Europe. The group’s toolset spans Linux implants—RushDrop, DriveSwitch, SilentRaid, and Bulbature—and Windows payloads such as RedLeaves and ShadowPad. UAT-7290 also maintains Operational Relay Box (ORB) infrastructure that can be repurposed to relay traffic for other threat actors.
Cisco Talos analyzed relevant samples and documented a staged Linux infection chain that begins with the RushDrop dropper creating a concealed .pkgdb directory. Subsequent stages deploy DriveSwitch and then the primary implant SilentRaid. These components use DNS resolution through public resolvers to reach command-and-control and support capabilities such as command execution, file management, and reverse shell establishment. Bulbature functions as an ORB node, listening on configurable ports and using a recurring self-signed certificate that Talos noted across numerous Chinese-hosted systems.
Harden edge networking devices by eliminating default credentials, restricting management exposure, and rapidly patching known one-day vulnerabilities. Monitor for anomalous DNS behavior—especially unexpected queries routed to public resolvers—along with unusual BusyBox command usage and the appearance of unfamiliar binaries within hidden directories. Where applicable, deploy endpoint and network protections capable of detecting the referenced ClamAV signatures and Snort SID 65124, and ensure alerting is wired to SOC workflows.
If suspicious activity is identified, isolate the affected device, capture volatile memory and disk images, and immediately block any confirmed C2 domains or IP addresses. Perform targeted forensics on the .pkgdb directory, /tmp configuration artifacts, and any evidence of spawned reverse shells. Reset compromised credentials, rotate SSH keys, and validate that no ORB nodes remain operational inside the environment.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
Attack Narrative & Commands:
Initial Dropper Execution (T1480.002): The attacker executes the RushDrop binary, which, as part of its payload, creates a hidden directory named .pkgdb in the current working directory.
Privileged Component Launch (T1569): The dropper then spawns SilentRaid with a plugins argument to load malicious modules that establish persistence via system services.
Network Discovery (T1016.001): Finally, the malware collects routing information to map the internal network:
When these three command‑line fragments appear together (or the first two together and the third as an alternative), the Sigma rule condition evaluates to true, generating an alert.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
