Know What's Happening in Technology

China-Linked UAT-7290 Targets Telecoms with Linux Malware and ORB Nodes

A China‑linked threat group identified as UAT‑7290 has been conducting espionage‑focused intrusions against telecom providers in South Asia and, more recently, organizations in southeastern Europe. The actor performs extensive reconnaissance before exploiting one‑day vulnerabilities and SSH brute‑force to compromise edge devices, deploying a Linux‑based malware suite that includes RushDrop, DriveSwitch and SilentRaid. UAT‑7290 also installs Operational Relay Box (ORB) nodes, turning compromised hardware into infrastructure that other China‑nexus actors can leverage. Researchers note overlap with known groups such as Stone Panda and RedFoxtrot, highlighting a broader supply‑chain threat.