{
  "name": "South American telecommunication providers targeted with three new malware implants",
  "slug": "south-american-telecommunication-providers-targeted-with-three-new-malware-implants",
  "description": "UAT-9244, a China-nexus advanced persistent threat actor, has been targeting critical telecommunications infrastructure in South America since 2024. The group employs three new malware implants: TernDoor, a Windows-based backdoor variant of CrowDoor; PeerTime, an ELF-based backdoor using BitTorrent protocol; and BruteEntry, a brute force scanner for SSH, Postgres, and Tomcat servers. UAT-9244 uses dynamic-link library side-loading, scheduled tasks, and registry modifications for persistence. The group is closely associated with FamousSparrow and Tropic Trooper, sharing similar tooling and tactics. Their infrastructure includes multiple command and control servers and operational relay boxes for scanning and brute-forcing activities.",
  "published": "2026-03-05T19:13:36+00:00",
  "created_at": "2026-03-05T19:13:36+00:00",
  "modified_at": "2026-03-06T10:23:39+00:00",
  "created_at_opencti": "2026-03-05T19:13:36+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-03-05",
    "apt",
    "bittorrent",
    "bruteentry",
    "china-nexus",
    "crowdoor",
    "peertime",
    "south america",
    "telecommunications",
    "terndoor"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "212.11.64.105"
      },
      {
        "id": "",
        "name": "154.205.154.70"
      },
      {
        "id": "",
        "name": "64.190.113.170"
      },
      {
        "id": "",
        "name": "185.196.10.247"
      },
      {
        "id": "",
        "name": "154.205.154.65"
      },
      {
        "id": "",
        "name": "185.196.10.38"
      },
      {
        "id": "",
        "name": "154.205.154.82"
      },
      {
        "id": "",
        "name": "154.223.21.194"
      },
      {
        "id": "",
        "name": "154.205.154.194"
      },
      {
        "id": "",
        "name": "38.60.199.34"
      },
      {
        "id": "",
        "name": "64.95.10.253"
      },
      {
        "id": "",
        "name": "38.54.125.134"
      },
      {
        "id": "",
        "name": "154.223.21.130"
      },
      {
        "id": "",
        "name": "bfc35f12d00fa4b40c5fbce9e37d704e12a52262709bcbdf09f97890bc40cad5"
      },
      {
        "id": "",
        "name": "17652d7bb5fe0454023db4fc7f608df0dbe6af237be31258e16ba52f0e895e26"
      },
      {
        "id": "",
        "name": "e34c9159e6e78c59518a14c5b96bddfee094b684f99d4f69b13371284a014e87"
      },
      {
        "id": "",
        "name": "74d1a678bdc4bb9f33321e94e3bd1bc1740472ed734231fc46af720072ecb77e"
      },
      {
        "id": "",
        "name": "0c7e36683a100a96f695a952cf07052af9a47f5898e1078311fd58c5fdbdecc8"
      },
      {
        "id": "",
        "name": "1cedf01dd4b7e50181d0e781825c66957b862941395d77c8bd7705114f319c80"
      },
      {
        "id": "",
        "name": "3d9fbfc2c056eac857ba54e5ed134aa45a4b8322ee9f9353ba32e5b2ca71b0e3"
      },
      {
        "id": "",
        "name": "3c098a687947938e36ab34b9f09a11ebd82d50089cbfe6e237d810faa729f8ff"
      },
      {
        "id": "",
        "name": "d78b3c6df8f3756a7e310cf7435fdba201dd03ec9f97420a0db683489a01a7c9"
      },
      {
        "id": "",
        "name": "38eeaa4eaad72feb3f8e6993565fcc548d8e7bb93642590f00fa24aacc0e2862"
      },
      {
        "id": "",
        "name": "66ce42258062e902bd7f9e90ad5453a901cfc424f0ea497c4d14f063f3acd329"
      },
      {
        "id": "",
        "name": "15d937803f90c2b9e277ff94d3e98ff30015ecc7f4623a158e3c98861e5cb278"
      },
      {
        "id": "",
        "name": "03eac9eb7f4b4bc494ef0496ee23cabbf38f883896838ed813741d8f64ac9fde"
      },
      {
        "id": "",
        "name": "c9fc2af30f769d856b88b3051f19fdb663b3e0a0916279df9bbcba93c6a110c9"
      },
      {
        "id": "",
        "name": "56bead2933e91366e4a0d5761daf5b238a7f2c22e597664ef67b3ecae20ab326"
      },
      {
        "id": "",
        "name": "9a7225c17e4bad3ffe7f080530d36f4f8aca5c116b913caa91ab9b0cee85638e"
      },
      {
        "id": "",
        "name": "023467e236a95d5f0e62e26445d430d749c59312f66cf136e6e2c2d526c46ba1"
      },
      {
        "id": "",
        "name": "74fbc8360d4c95d64d7acaa4d18943dce2d41f91d080b0b5e435d8bce52861a5"
      },
      {
        "id": "",
        "name": "2c3f2261b00ea45e25eb4e9de2b7ff8e41f311c0b3d986461f834022c08b3b99"
      },
      {
        "id": "",
        "name": "06b23d84fd7afd525dfd7860ebd561dcdd72ccbeb51981d5d9a75acf068d0a2a"
      },
      {
        "id": "",
        "name": "2d2ca7d21310b14f5f5641bbf4a9ff4c3e566b1fbbd370034c6844cedc8f0538"
      },
      {
        "id": "",
        "name": "00735a8a50d2856c11150ef1e29c05acebce7ad3edad00e37c7f043aacb46330"
      },
      {
        "id": "",
        "name": "3fcadde4b414a18b2fed56c1ec59d97977123615fbbf411a1c78425445a6e71c"
      },
      {
        "id": "",
        "name": "a313f76fca50fff1bcd6f2c6cbc1268985f8c0a3a05fe7f43c4fc0ac3aff84dc"
      },
      {
        "id": "",
        "name": "d5eb979cb8a72706bfa591fa57d4ebf7d13cecdc9377b0192375e2f570f796df"
      },
      {
        "id": "",
        "name": "66adeedfb739774fcc09aa7426c8fad29f8047ab4caee8040d07c0e84d011611"
      },
      {
        "id": "",
        "name": "6ec070457d1f6f239cb02c5e1576a3660cca98f3a07eec6e4e107f698d7fe555"
      },
      {
        "id": "",
        "name": "34d64b3cd9430e85edefcb883973a086dd5de9917e05fabec89b1f4ab9627e91"
      },
      {
        "id": "",
        "name": "7b70cd956f082b1029d02b4cb7608893f2de7fa9c500d7d7febdd0f745ac3cb6"
      },
      {
        "id": "",
        "name": "6a2d23cc8746a83e9a3b974788fce0e414706b8e75ff390426dd7e10b19967b3"
      },
      {
        "id": "",
        "name": "c9a42423ef08bd7f183915780d39530eba5e4e25968c51965ff8bb3026965a28"
      },
      {
        "id": "",
        "name": "870e791af14caaf395c56028176a9c3f4c1ff0318ef3112d57ecd3d4a1be2ef9"
      },
      {
        "id": "",
        "name": "66bdce93de3b02cf9cdadad18ca1504ac83e379a752d51f60deae6dcbafe4e31"
      },
      {
        "id": "",
        "name": "1fcdd5a417db31e5e07d32cecfa69e53f0dce95b7130ad9c03b92249f001801d"
      },
      {
        "id": "",
        "name": "f3e899789b56429f483e5096e1f473335024f1f763e2d428132338e30352b89e"
      },
      {
        "id": "",
        "name": "a5e413456ce9fc60bb44d442b72546e9e4118a61894fbe4b5c56e4dfad6055e3"
      },
      {
        "id": "",
        "name": "711d9427ee43bc2186b9124f31cba2db5f54ec9a0d56dc2948e1a4377bada289"
      },
      {
        "id": "",
        "name": "f36913607356a32ea106103387105c635fa923f8ed98ad0194b66ec79e379a02"
      },
      {
        "id": "",
        "name": "babc81fc9c998e9dc4ab545f0e112e34d2641e1333bc81aaa131abd061a5b604"
      },
      {
        "id": "",
        "name": "3fcced9332301ff70b20c98c9434c858400013d659afa6bb5149cffb0206357d"
      },
      {
        "id": "",
        "name": "075b20a21ea6a0d2201a12a049f332ecc61348fc0ad3cfee038c6ad6aa44e744"
      },
      {
        "id": "",
        "name": "ebcb2691b7c92cdf2b2ff5e2d753abeea8cb325c16596cd839e6bd147f80e38a"
      },
      {
        "id": "",
        "name": "f8066833e47814793d8c58743622b051070dac09cb010c323970c81b59260f84"
      },
      {
        "id": "",
        "name": "1f5635a512a923e98a90cdc1b2fb988a2da78706e07e419dae9e1a54dd4d682b"
      }
    ],
    "malware": [
      {
        "id": "55b95ab2-967f-4ad6-92b1-d862f9238c27",
        "name": "CrowDoor",
        "slug": "crowdoor"
      },
      {
        "id": "8cee5bf7-58e2-45d4-856a-07e9b3c4125d",
        "name": "PeerTime",
        "slug": "peertime"
      },
      {
        "id": "f3498120-d2f9-4939-a6ab-fd3040baa17d",
        "name": "TernDoor",
        "slug": "terndoor"
      },
      {
        "id": "4b2bfba8-20d4-47e6-990a-96a6c764caf7",
        "name": "BruteEntry",
        "slug": "bruteentry"
      }
    ],
    "intrusion_sets": [
      {
        "id": "c575e6e7-c862-4f20-90eb-232a0810d88b",
        "name": "UAT-9244",
        "slug": "uat-9244"
      }
    ],
    "attack_patterns": [
      {
        "id": "e8422fc8-8365-4a6a-a556-d6ec16cb4e5d",
        "name": "T1574.002"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Telecommunications"
      },
      {
        "id": "",
        "name": "xcit76.com"
      },
      {
        "id": "",
        "name": "xtibh.com"
      },
      {
        "id": "",
        "name": "bloopencil.net"
      }
    ]
  },
  "external_refs": [
    "https://blog.talosintelligence.com/uat-9244/",
    "https://otx.alienvault.com/pulse/69a9e3f038f67d31461ec191"
  ]
}