Cybersecurity Threat Advisory: Telecoms targeted with new malware

A China‑connected enlarged persistent threat (APT) group, identified as UAT‑9244, is conducting a long‑running cyber‑espionage campaign against telecom providers in South America. The group uses three new custom malware implants (including TernDoor, PeerTime, and BruteEntry) across Windows, Linux, and network‑edge devices to gain deep, persistent access to carrier networks, move laterally, and potentially monitor or disrupt communications.

The campaign leverages three previously undocumented malware families:

• TernDoor is delivered via DLL side‑loading, abusing the legitimate wsprint.exe to load a malicious BugSplatRc64.dll, which decrypts and injects the final payload into msiexec.exe in memory. It includes an embedded Windows driver, WSPrint.sys, to terminate, suspend, and resume processes. Persistence is maintained through scheduled tasks and Registry changes, which also conceal the task. TernDoor supports remote shell command execution, running arbitrary processes, file read/write, system reconnaissance, and self‑uninstallation.
• PeerTime is an ELF Linux backdoor compiled for multiple architectures (ARM, AARCH, PPC, MIPS), enabling compromise of diverse embedded systems and telecom network devices. Cisco Talos identified two variants—one in C/C++ and one in Rust—with Simplified Chinese debug strings in the instrumentor binary. Its payload is decrypted and run in memory, and the process name is changed to appear benign. As a P2P backdoor, PeerTime uses the BitTorrent protocol for C2, retrieves and executes payloads from peers, and relies on BusyBox to write files to disk.
• BruteEntry consists of a Go-based instrumentor and a brute-force component that turns infected hosts into scanning nodes, or Operational Relay Boxes (ORBs). These ORBs scan for new targets and attempt to brute-force SSH, PostgreSQL, and Tomcat services, reporting login results, status, and notes back to the C2 server.

The primary risk is deep, long‑term compromise of core telecom infrastructure. This gives the China‑linked APT UAT‑9244 high‑privilege access to Windows, Linux, and network‑edge devices that route and manage customer traffic. This exposes the confidentiality and integrity of communications. Attackers could potentially monitor, reroute, or tamper with voice, data, and signaling, as well as sensitive subscriber and corporate. By turning compromised hosts into scanning and brute‑force nodes, the toolkit also enables follow‑on attacks against downstream customers and partners. In addition, the use of DLL side‑loading and BitTorrent‑based P2P command‑and‑control makes detection and eradication difficult. This increases the likelihood of prolonged, stealthy espionage and potential disruption.