UAT-8302 Threat Group Steals Government Data With Custom Malware

Key Takeaways

• A China-linked advanced persistent threat (APT) group, UAT-8302, is targeting government entities in southeastern Europe.
• The group employs a sophisticated blend of custom malware and legitimate cloud services, making detection challenging.
• UAT-8302 focuses on long-term data exfiltration and persistent access, indicating state-sponsored objectives.
• The threat group utilizes a diverse arsenal of backdoors, implants, and open-source tools for reconnaissance, lateral movement, and command and control.

China-Linked APT Group UAT-8302 Exploits Custom Malware and Open-Source Tools for Government Data Theft

A highly sophisticated threat actor, identified as UAT-8302 and believed to be linked to China, has been actively engaged in cyber espionage against government organizations, particularly in southeastern Europe. Active since at least late 2024, the group significantly escalated its operations throughout 2025, demonstrating a clear objective: establish covert, long-term access to exfiltrate sensitive information.

The danger posed by UAT-8302 stems from its remarkable ability to evade detection. By integrating legitimate cloud services and readily available open-source tools with its bespoke malware, the group effectively camouflages malicious activities within normal network traffic, presenting a significant challenge for defensive measures.

Researchers at Cisco Talos identified UAT-8302 as a China-nexus advanced persistent threat group, primarily tasked with acquiring and maintaining prolonged access to government and associated entities globally. Talos analysts confidently assert that UAT-8302 shares specific tools with other previously documented China-nexus clusters, including one tracked as LongNosedGoblin. This overlap in methodologies and tools suggests a close operational relationship among these groups.

Methodical Reconnaissance and Evasion Tactics

UAT-8302 exhibits exceptional patience, conducting exhaustive and systematic reconnaissance on every accessible endpoint before attempting deeper penetration into target environments. This meticulous, deliberate approach is a recognized characteristic of state-sponsored threat operations targeting high-value governmental infrastructure. Their strategy emphasizes stealth and persistence over rapid, disruptive attacks.

UAT-8302’s Custom Malware Arsenal

Once initial compromise is achieved, UAT-8302 follows a comprehensive post-compromise playbook. Their activities include credential harvesting, Active Directory information gathering, and meticulous mapping of the entire network infrastructure before deploying additional malware. This thorough understanding of the compromised environment dictates their subsequent moves.

The group leverages tools such as Impacket, custom PowerShell scripts, and open-source scanning engines to identify every reachable endpoint. This ensures a complete grasp of the network’s scope before proceeding with data exfiltration or further compromise.

The diverse array of malware families employed by UAT-8302 indicates a well-resourced and extensive toolkit. The group deploys NetDraft, a .NET-based backdoor linked to the FinDraft and SquidDoor families. They also utilize an updated version of the CloudSorcerer backdoor and the VSHELL implant. In one documented incident, UAT-8302 deployed SNAPPYBEE and ZingDoor concurrently, a tactic previously highlighted by Trend Micro in 2024 reporting on similar China-linked activities.

Malware Deep Dive: NetDraft and CloudSorcerer

NetDraft stands out as a key component of UAT-8302’s arsenal. It is typically delivered via a DLL side-loading technique, where a legitimate executable inadvertently loads a malicious DLL-based loader. This loader then decodes and executes NetDraft within an existing process on the compromised system. A critical feature of NetDraft is its use of the Microsoft Graph API for command-and-control (C2) communication, routing through OneDrive. This method allows the malware to blend seamlessly with legitimate cloud traffic, significantly hindering detection efforts. Talos refers to the embedded helper library used by NetDraft as “FringePorch.”

CloudSorcerer version 3 demonstrates adaptive behavior based on its execution environment. When injected into “dnapimg.exe,” it gathers system details and then pivots to “explorer.exe” to receive commands through a named pipe channel. Conversely, if executed within “spoolsv.exe,” it establishes contact with a GitHub repository to retrieve C2 information. This polymorphic behavior makes traditional security tools less effective. Talos also noted the presence of SNOWRUST, a Rust-based variant of the SNOWLIGHT stager, which has been observed in intrusions attributed to other China-nexus clusters.

Open-Source Tools and Lateral Movement

UAT-8302 extensively employs open-source tools for lateral movement within compromised networks. Following initial access, the group utilizes scanning utilities like gogo, naabu, httpx, and PortQry to map internal network services and identify new systems for pivoting. Credential harvesting is performed using tools such as adconnectdump.py and SharpGetUserLoginRDP, targeting MobaXterm sessions and Active Directory.

For maintaining persistent backdoor access, the group deploys Stowaway, a proxy tunneling tool developed in Simplified Chinese, which funnels external traffic into infected hosts within the enterprise. SoftEther VPN clients have also been observed in use, further enhancing their ability to maintain covert access.

What You Should Do

• Enhance Endpoint Detection: Ensure all endpoint detection and response (EDR) tools are up-to-date with the latest threat signatures to identify UAT-8302 malware families and associated tools.
• Monitor Cloud Traffic: Implement robust monitoring for unusual outbound traffic patterns to legitimate cloud platforms like OneDrive and GitHub, as these are exploited for C2 communications.
• Audit Scheduled Tasks and DLL Sideloading: Regularly audit scheduled tasks and investigate any suspicious DLL side-loading behavior across all managed endpoints, as these are common initial infection vectors.
• Strengthen Credential Management: Implement multi-factor authentication (MFA) across all accounts, especially for Active Directory and remote access services, and regularly rotate credentials.
• Network Segmentation: Segment networks to limit lateral movement in the event of a breach, making it harder for attackers to reach high-value assets.
• Threat Intelligence Integration: Integrate the provided Indicators of Compromise (IoCs) into your security information and event management (SIEM) systems and other security tools for proactive detection.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.