Chinese state-sponsored hackers, specifically a group tracked as UAT-9244, have been targeting telecommunications providers in South America and other regions using a newly discovered malware toolkit. This activity is part of a broader trend of Chinese “Typhoon” groups—like Salt Typhoon and Volt Typhoon—systematically infiltrating global telecom infrastructure for long-term espionage and data theft.

The New Malware Toolkit

Researchers from Cisco Talos identified three previously undocumented malware families used in this campaign:

• TernDoor: A sophisticated Windows backdoor deployed via DLL side-loading. It primarily targets internal Windows environments for persistent access.
• PeerTime: A Linux-based backdoor that uniquely uses the BitTorrent protocol for its command-and-control (C2) communications, making its traffic harder to distinguish from normal network activity.
• BruteEntry: A specialized brute-force scanner designed to build proxy infrastructures known as Operational Relay Boxes (ORBs), which help attackers mask their true origins.

Recent Major Telecom Attacks

This toolkit discovery follows several other high-profile Chinese hacking operations:

• Salt Typhoon (US/Global): In late 2024 and early 2025, this group infiltrated major US carriers including AT&T, Verizon, and T-Mobile. They reportedly accessed systems used for court-approved wiretapping and stole communications from high-profile political figures.
• UNC2814 (Worldwide): This group was found using Google Sheets as C2 infrastructure to breach at least 53 telecom operators across 42 countries.
• Silver Dragon (APT41): Recently linked to attacks in Europe and Southeast Asia, using Google Drive for C2.

Tactics and Objectives

• Persistence: Hackers often focus on edge devices (routers and firewalls) from vendors like Cisco and Juniper Networks to maintain long-term, stealthy access.
• Data Theft: Primary goals include harvesting call records (metadata), intercepting text messages, and gaining access to lawful intercept portals.
• Detection Evasion: Groups use “Living off the Land” techniques, using a network’s own built-in tools to execute commands without installing detectable files.