TL;DR

Cisco Talos on May 5, 2026 publicly identified UAT-8302, a high-confidence China-nexus APT that has been quietly penetrating government networks in South America and southeastern Europe since at least late 2024. What makes UAT-8302 strategically unusual is not novel zero-day development — it is the systematic reuse of seven malware families originally built and operated by at least six other PRC-aligned threat clusters. The group's operations reveal a "Premier Pass-as-a-Service" collaboration model inside China's APT ecosystem: shared loaders, stagers, and backdoors deployed interchangeably across geographically separate campaigns. Defenders relying on actor-specific detection will miss every variant.

---

Background: Who Is UAT-8302?

UAT-8302 is a designation created by Cisco Talos researchers Jungsoo An, Asheer Malhotra, and Brandon White after tracking a distinct campaign cluster that cross-wires multiple previously known China-aligned threat groups into a single operational node. The group targets government entities and adjacent organizations — ministries, diplomatic outposts, and government-linked IT firms — with a primary mission assessed as long-term persistent access and information collection rather than immediate destructive or ransomware activity.

Known operational timeline:

• Late 2024 – present: Active against government entities across South America
• 2025 – present: Targeting government agencies in southeastern Europe

The expansion into South America is significant. Until 2023, PRC cyber espionage was heavily concentrated in Southeast Asia, Japan, Taiwan, and US/NATO-adjacent targets. The 2025–2026 shift to Latin American governments — particularly with tools shared across the broader Chinese APT ecosystem — suggests a deliberate strategic tasking by Beijing's intelligence apparatus to gain persistent footholds in regions that are emerging geopolitical battlegrounds for PRC diplomatic and economic influence.

Attribution confidence: high. The overlap between UAT-8302's tooling and at least six separately verified China-nexus APT clusters provides multiple independent attribution anchors that do not depend on a single shared indicator.

---

Technical Analysis: The Shared Arsenal Model

Why "Shared Arsenal" Matters

Before examining UAT-8302's specific tools, it is worth explaining why the "shared arsenal" discovery changes how defenders should think about PRC threat actors.

Traditional threat actor profiling builds detection around the unique signatures of a single group — specific malware families, C2 patterns, initial access preferences, and target profiles. This works when APT groups maintain proprietary toolsets. It fails when, as Talos describes it, a "Premier Pass-as-a-Service" model exists: shared infrastructure and custom malware that flows between China-aligned groups as an informal capability-sharing arrangement.

The practical consequence for detection engineering:

• A YARA rule written against a UAT-8302 intrusion in a South American foreign ministry will also fire on an Earth Estries campaign against a European defense contractor
• A CloudSorcerer C2 detection indicator generated from a Russian government compromise in 2024 is now reusable against UAT-8302 targets in Bogotá and Bucharest
• Single-actor attribution models — "this is Earth Estries, not our problem" — collapse entirely

Malware Family Inventory

UAT-8302 has been observed deploying the following families across its documented intrusions:

---

#### 1. NetDraft (aka NosyDoor / LuckyStrike Agent)

Type: .NET Framework (C#) backdoor

Shared with: Jewelbug / REF7707 / CL-STA-0049 / LongNosedGoblin / Ink Dragon / Earth Alux

History: Originally developed by the Jewelbug cluster (tracked by Recorded Future) as FINALDRAFT/SquidDoor — a backdoor designed to abuse Microsoft Graph API and Outlook draft messages as a covert C2 channel. Commands arrive as unsent draft messages in an attacker-controlled inbox; the implant polls the drafts folder, executes the commands, and writes results back as new drafts. No email is ever actually sent, making the C2 channel invisible to email flow-based detection.

NetDraft is the .NET-ported evolution of this family. ESET tracks its operator as LongNosedGoblin targeting government organizations in Southeast Asia and Japan. Russian cybersecurity firm Solar observed the same binary — renamed LuckyStrike Agent — deployed by Erudite Mogwai (Space Pirates/Webworm) against Russian IT organizations in 2024. UAT-8302 is now the third distinct cluster observed using functionally the same implant.

Detection note: The Graph API / Outlook draft C2 channel bypasses most email DLP controls and endpoint detection that monitors for outbound SMTP/IMAP connections. Detection must monitor for anomalous Microsoft Graph API usage patterns from non-user processes, particularly Draft.ReadWrite scope calls from unexpected binaries.

---

#### 2. CloudSorcerer Version 3

Type: Multi-stage persistent backdoor

Shared with: Erudite Mogwai (Space Pirates / Webworm)

History: CloudSorcerer was first disclosed by Kaspersky in 2024 as a sophisticated backdoor targeting Russian government entities — notable at the time for a Chinese APT deploying against Russian targets. Version 3 introduces a living-off-the-cloud C2 discovery mechanism:

CloudSorcerer v3 contacts a specific GitHub repository or a GameSpot user profile page set up by the threat actors to retrieve an encoded blob containing the actual C2 server address.

This is a textbook T1102 (Web Service as C2) implementation. The initial network connection from the implant goes to github.com or gamespot.com — legitimate, globally trusted, and HTTPS-encrypted. Firewall rules that block "suspicious" domains will not intercept this. The C2 address itself is only revealed after the implant successfully retrieves and decodes the blob from the trusted hosting platform.

Why version 3 matters beyond the C2 trick: CloudSorcerer's appearance in UAT-8302 operations targeting South America confirms the earlier hypothesis that Erudite Mogwai's 2024 Russian government campaign was testing infrastructure that would be handed to operationally separate units for deployment against new targets. The same backdoor, third-generation, is now active on three continents against four distinct governmental target sets.

---

#### 3. VSHELL + SNOWLIGHT + SNOWRUST (new)

Type: Shellcode implant (VSHELL), stager (SNOWLIGHT), Rust stager (SNOWRUST, first observed here)

Shared with: UNC5174, UNC6586, UAT-6382 (Cityworks zero-day exploitation, CVE-2025-0994)

VSHELL is a cross-platform post-exploitation framework with Linux and macOS variants, used heavily by China-nexus actors since 2024. SNOWLIGHT is the purpose-built stager for VSHELL delivery. UAT-8302 adds SNOWRUST — a new Rust-language rewrite of the SNOWLIGHT stager — to this chain, first observed in these campaigns.

The Rust rewrite is significant for two reasons:

1. Detection evasion: Rust-compiled binaries have unusual memory layouts and lack standard C runtime signatures that many antivirus and EDR heuristics target

2. Cross-platform flexibility: Rust makes cross-compilation to Linux/macOS/Windows trivial, suggesting UAT-8302 is hardening the VSHELL deployment chain for broader target environments

---

#### 4. SNAPPYBEE / DeedRAT

Type: Remote Access Trojan (ShadowPad successor)

Shared with: Earth Estries, Earth Naga

DeedRAT / SNAPPYBEE is the functional successor to ShadowPad — one of the most widely distributed China-nexus RATs, originally attributed to APT41. Earth Estries' deployment of DeedRAT was documented by Trend Micro in late 2024 alongside ZingDoor, and UAT-8302 replicates the same dual-deployment pattern in its own campaigns.

---

#### 5. ZingDoor

Type: DLL backdoor

Shared with: Earth Estries

A DLL-based backdoor first identified in Earth Estries operations in 2023. UAT-8302's use — specifically in conjunction with SNAPPYBEE, mirroring Earth Estries' documented pairing pattern — is one of the key overlap indicators driving the Talos attribution.

---

#### 6. Draculoader

Type: Generic shellcode loader

Shared with: Earth Estries, Earth Naga

A loader used to deliver Crowdoor and HemiGate backdoors. Its presence in UAT-8302 operations alongside the Earth Estries-specific DeedRAT + ZingDoor combination reinforces the "Premier Pass-as-a-Service" shared infrastructure model: UAT-8302 is not merely borrowing a single tool, but inheriting entire component chains from multiple upstream groups.

---

Post-Compromise Tradecraft

After initial access (assessed by Talos to follow the broader China-nexus pattern of exploiting zero-days and n-days in internet-facing appliances), UAT-8302 follows a structured reconnaissance pattern:

Phase 1 — Initial recon (standard)

ipconfig /all, whoami, systeminfo, net user, net localgroup, nslookup, nltest

Phase 2 — Extended automated recon (whatpc.ps1)

A custom PowerShell script (whatpc.ps1) dropped to C:\Windows\Temp\ and persisted via scheduled task:

schtasks /create /tn 'ReconLiteDebug' /tr 'powershell -ExecutionPolicy Bypass -WindowStyle Hidden -File c:\windows\temp\whatpc.ps1' /sc ONCE /st 08:25 /ru SYSTEM /f

The script executes ~20 enumeration commands and is designed to profile every new endpoint the actor reaches during lateral movement.

Phase 3 — Network expansion

Ping sweeps and automated scanning via the open-source gogo scanner. Lateral movement using Impacket (WMI-exec, PsExec-style) and custom proxying tools for network traversal.

Phase 4 — Persistent access

Deployment of the full malware stack: CloudSorcerer v3 for long-term covert access; NetDraft for low-noise C2 via Outlook drafts; VSHELL/SNOWRUST for interactive shell access on demand.

---

Indicators of Compromise (IOCs)

Network / C2 Infrastructure

| Indicator | Type | Notes |

|-----------|------|-------|

| moonzonet[.]com | C2 domain | Observed in UAT-8302 campaign (overlaps with related cluster) |

| GitHub repository (attacker-controlled) | C2 resolver | CloudSorcerer v3 retrieves encoded C2 address from blob |

| GameSpot user profile page (attacker-controlled) | C2 resolver | CloudSorcerer v3 alternate C2 discovery mechanism (T1102) |

Host-Based Artifacts

| Indicator | Type | Notes |

|-----------|------|-------|

| C:\Windows\Temp\whatpc.ps1 | PowerShell recon script | Dropped on every laterally compromised host |

| Scheduled Task: ReconLiteDebug | Persistence | SYSTEM-privilege PowerShell execution |

| Scheduled Task: RunWhatPC | Persistence | Batch file runner for automated recon |

| SNOWRUST binary | Rust executable | Unusual memory layout; no standard C-runtime signatures |

| NetDraft / NosyDoor | .NET assembly | Graph API Outlook draft C2 channel |

MITRE ATT&CK TTPs

| TTP | Technique ID | Description |

|-----|-------------|-------------|

| Valid Accounts | T1078 | Credential extraction and reuse post-initial compromise |

| Web Service C2 | T1102 | CloudSorcerer v3 GitHub/GameSpot C2 resolution |

| Scheduled Task/Job | T1053.005 | ReconLiteDebug / RunWhatPC persistence |

| PowerShell | T1059.001 | whatpc.ps1 automated recon |

| Lateral Tool Transfer | T1570 | Impacket-based lateral movement |

| Obfuscated Files/Information | T1027 | Encoded C2 address in GitHub blob |

| Email Collection / Draft Abuse | T1114 | NetDraft Outlook draft C2 channel |

| OS Credential Dumping | T1003 | Post-compromise credential extraction noted |

| Network Service Discovery | T1046 | gogo automated network scanning |

| Masquerading | T1036 | Tools dropped to C:\Windows\Temp\ with system-utility names |

---

Lyrie Take: Why UAT-8302 Is a Detection Engineering Inflection Point

The fundamental challenge UAT-8302 poses is not tactical — it's architectural. When a single APT node can freely deploy CloudSorcerer (originally Russian government-targeting malware), NetDraft (originally Southeast Asia-focused), DeedRAT (originally Earth Estries' ShadowPad successor), and a new Rust-based stager in the same intrusion, your threat actor library becomes a liability rather than an asset.

The three failure modes UAT-8302 exposes:

1. "Not our threat actor" dismissal. A government entity in Colombia that sees DeedRAT or ZingDoor detections may assume "that's Earth Estries, they target healthcare and telecom in the US" and deprioritize the investigation. UAT-8302 deploys the same tooling against entirely different target verticals.

2. Malware-family-specific detection gaps. If your detections were built around FINALDRAFT's PowerShell-based variant and not its .NET port (NetDraft), you will miss UAT-8302. If your detections target SNOWLIGHT but not a Rust-compiled SNOWRUST binary, you will miss the stager. The Rust rewrite specifically targets this gap.

3. C2 whitelisting failure. CloudSorcerer v3's GitHub and GameSpot C2 resolution pattern is particularly difficult because no enterprise network blocks github.com or gamespot.com. TLS inspection of those domains is technically feasible but organizationally rare. The C2 call looks like a developer checking a repo or an employee visiting a gaming news site.

What Lyrie's approach addresses: Lyrie's behavioral analysis layer monitors for the behavioral chain rather than individual indicator matches — a process making Graph API Draft.ReadWrite calls combined with network reachout to a legitimate content platform combined with scheduled task creation in C:\Windows\Temp\ triggers as a pattern, regardless of which specific malware family is responsible. This is the only reliable detection model against shared-arsenal APT operations.

---

Defender Playbook

Immediate (0–48 hours)

• [ ] Search EDR/SIEM for whatpc.ps1 in %TEMP% or C:\Windows\Temp\
• [ ] Hunt for scheduled tasks named ReconLiteDebug or RunWhatPC with SYSTEM privilege and PowerShell execution
• [ ] Review Microsoft Graph API access logs for Draft.ReadWrite scope from non-Outlook processes
• [ ] Check proxy/firewall logs for outbound HTTPS to GitHub or GameSpot from non-browser processes — specifically looking for short, infrequent GETs to user profile or gist URLs with no referrer

Detection Engineering

• [ ] Deploy YARA rules for SNOWRUST Rust-compiled stager binaries (available in Cisco Talos and CiphersSecurity advisories)
• [ ] Build SIEM correlation rule: scheduled task creation + SYSTEM privilege + script in Temp directory within same 5-minute window
• [ ] Add NetDraft .NET assembly signatures to EDR custom detection (distinct from PowerShell-based FINALDRAFT variants)
• [ ] Enable Microsoft Graph API audit logs; alert on unexpected Draft.ReadWrite grants or unusual service principal Graph activity

Strategic Hardening

• [ ] Apply principle of least privilege to service accounts that can reach internet — critical for blocking gogo scanner lateral spread
• [ ] Segment government-facing endpoints from internal networks; UAT-8302's recon scripts assume flat networks where LDAP/Kerberos queries succeed
• [ ] Review TLS inspection posture for "trusted" domains including github.com, gamespot.com; C2 resolution over legitimate platforms requires HTTPS inspection to detect
• [ ] Cross-reference any SNAPPYBEE/DeedRAT or ZingDoor detections against UAT-8302 IOCs — do not assume Earth Estries attribution without verifying campaign context
• [ ] Threat hunt for Impacket artifacts: WMI execution artifacts, SMB lateral movement logs, NTLM relay evidence in Windows Security Event logs

For Government and Critical Infrastructure SOCs

• [ ] Brief threat intelligence teams on the "Premier Pass-as-a-Service" model: single-actor attributions may be wrong; tool-based detections are required
• [ ] If in South America or southeastern Europe: treat any unidentified .NET backdoor with Graph API activity as potential UAT-8302 and escalate immediately
• [ ] Mandatory: pull in CISA/NCSC shared IOC feeds from the broader Jewelbug / REF7707 / Earth Estries cluster family, not just UAT-8302-specific indicators

---

Sources

1. Cisco Talos — "UAT-8302 and its box full of malware" (May 5, 2026): https://blog.talosintelligence.com/uat-8302/

2. The Hacker News — "China-Linked UAT-8302 Targets Governments Using Shared APT Malware Across Regions" (May 2026): https://thehackernews.com/2026/05/china-linked-uat-8302-targets.html

3. CiphersSecurity — "UAT-8302 China APT Malware Analysis: Shared Implants, IOCs, And Detection Rules": https://cipherssecurity.com/uat-8302-china-apt-shared-malware-iocs-yara-detection/

4. Kaspersky Securelist — "CloudSorcerer / EastWind APT Campaign" (2024): https://securelist.com/eastwind-apt-campaign/113345/

5. Trend Micro — "Premier Pass-as-a-Service" (2025): https://www.trendmicro.com/en_us/research/25/j/premier-pass-as-a-service.html

6. SOC Prime — "UAT-8302 and the Malware Toolkit Behind Its Attacks": https://socprime.com/active-threats/uat-8302-and-the-malware-toolkit-behind-its-attacks/

---

Lyrie.ai Cyber Research Division — Senior Analyst Desk