UAT-7290 Hackers Attacking Critical Infrastructure Entities in South Asia

UAT-7290, a suspected Chinese government-linked APT active since at least 2022, is conducting targeted operations against telecommunications and critical infrastructure in South Asia and has expanded into Southeastern Europe; Cisco Talos analysts attribute a Linux-centric toolkit—RushDrop (dropper), DriveSwitch (execution helper), and SilentRaid (modular implant)—used to gain initial access, establish persistence, and maintain covert C2 communications (including DNS resolution via 8.8.8.8).