UAT-8302 Deploys Custom Malware Against Government Networks

UAT-8302, a China-linked APT active since late 2024, has been targeting government infrastructures in South America and southeastern Europe; researchers report the group uses custom backdoors (NetDraft, CloudSorcerer, FringePorch), PowerShell and Python reconnaissance tools (whatpc, Impacket), open-source scanners, credential theft from Active Directory/Microsoft Entra ID, DLL sideloading, and hidden proxy tunnels to maintain long-term clandestine access and exfiltrate intelligence.