South American telecommunication providers targeted with three new malware implants
UAT-9244, a China-nexus advanced persistent threat actor, has been targeting critical telecommunications infrastructure in South America since 2024. The group employs three new malware implants: TernDoor, a Windows-based backdoor variant of CrowDoor; PeerTime, an ELF-based backdoor using BitTorrent protocol; and BruteEntry, a brute force scanner for SSH, Postgres, and Tomcat servers. UAT-9244 uses dynamic-link library side-loading, scheduled tasks, and registry modifications for persistence. The group is closely associated with FamousSparrow and Tropic Trooper, sharing similar tooling and tactics. Their infrastructure includes multiple command and control servers and operational relay boxes for scanning and brute-forcing activities.
Pulse ID: 69a9e3f038f67d31461ec191
Pulse Link: https://otx.alienvault.com/pulse/69a9e3f038f67d31461ec191
Pulse Author: AlienVault
Created: 2026-03-05 20:13:36
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#BackDoor #BruteForce #China #CyberSecurity #ELF #ICS #InfoSec #Malware #OTX #OpenThreatExchange #RAT #RCE #SSH #SouthAmerica #Telecom #Telecommunication #Tomcat #Windows #bot #AlienVault