UAT-8302 Uses Custom Malware and Open-Source Tools to Steal Data From Government Agencies

This report details UAT-8302, a China-linked APT that has targeted government agencies since late 2024 using a mix of custom malware (NetDraft, CloudSorcerer, VSHELL, SNAPPYBEE, ZingDoor), open-source reconnaissance tools, and cloud-based C2 channels (OneDrive, GitHub, Cloudflare Workers) to maintain stealthy, long-term access and exfiltrate sensitive data; the document provides observed tactics, techniques, procedures and a comprehensive set of IoCs for detection and mitigation.