Malware

DriveSwitch

According to Cisco Talos, DriveSwitch is a launcher for SilentRaid.

Indicators of Compromise 12

Domain 8[.]8[.]8[.]8 Filename .pkgdb Filename Bulbature Filename DriveSwitch Filename RushDrop Filename SilentRaid Filename busybox Filename chargen Filename daytime SHA-256 59568d0e2da98bad46f0e3165bcf8adadbf724d617ccebcfdaeafbb097b81596 SHA-256 723c1e59accbb781856a8407f1e64f36038e324d3f0bdb606d35c359ade08200 SHA-256 961ac6942c41c959be471bd7eea6e708f3222a8a607b51d59063d5c58c54a38d

MITRE ATT&CK TTPs 11

T1027
Obfuscated Files or Information
Defense Evasion
 T1057
Process Discovery
Discovery
 T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1082
System Information Discovery
Discovery
 T1083
File and Directory Discovery
Discovery
 T1090
Proxy
Command And Control
 T1105
Ingress Tool Transfer
Command And Control
 T1124
System Time Discovery
Discovery
 T1133
External Remote Services
Persistence
 T1566
Phishing
Initial Access

Source Articles

UAT-7290 targets high value telecommunications infrastructure in South Asia
Cisco Talos has identified a sophisticated China-nexus APT group tracked as UAT-7290, active since at least 2022, targeting high-value telecommunications infrastructure in South Asia and recently expanding into Southeastern Europe. The group conducts espionage and establishes Operational Relay Box (ORB) nodes using a suite of custom and open-source malware, including RushDrop, DriveSwitch, SilentRaid, and Bulbature. UAT-7290 leverages one-day exploits, SSH brute-forcing, and publicly available proof-of-concept code to compromise edge devices and gain initial access. Technical overlaps with APT10 and Red Foxtrot, as well as shared infrastructure and malware traits, suggest ties to Chinese state-sponsored actors.
static-urls