UAT-8302 Targets Government Agencies With Custom Malware and Open-Source Tools

UAT-8302 is a China-linked APT conducting stealthy, long-term espionage against government organizations in South America and southeastern Europe using custom implants (NetDraft/FringePorch, CloudSorcerer, VSHELL/SNOWRUST), DLL side-loading, cloud-based C2, extensive AD and credential theft, and open-source tunneling and reconnaissance tools; defenders should prioritize behavior-based detection, robust logging, and signatures for known components.