China-Linked Hackers Use Malware Trio for Telecom Espionage

A China-linked cyberespionage group has been targeting telecommunications providers in South America since 2024 using a set of newly discovered malware tools designed to maintain persistent access to critical communications infrastructure, Cisco Talos researchers found.

See Also: Experts Offer Insights from Theoretical to the Realities of AI-enabled Cybercrime

The threat intelligence company tracks the group as UAT-9244 and says it overlaps with Chinese advanced persistent threat groups Famous Sparrow and Tropic Trooper.

Famous Sparrow has been active since at least 2019, with a history of targeting hotels, governments, international organizations and law firms. Tropic Trooper has operated since at least 2011, focusing primarily on government agencies, transportation networks and high-tech industries across Taiwan, the Philippines and Hong Kong, with more recent activity reported in the Middle East.

The campaign focuses on telecommunications networks, which provide access to large volumes of sensitive communications data and can serve as strategic intelligence collection points for nation-state actors.

Cisco Talos identified three previously undocumented malware families used in the intrusions: a Windows backdoor dubbed TernDoor, a Linux backdoor called PeerTime and a credential brute-forcing tool known as BruteEntry.

Researchers observed the attackers using DLL side-loading techniques to deploy TernDoor, a process in which a legitimate executable loads a malicious library that decrypts and launches the final payload in memory, injected into the Windows process msiexec.exe to blend in with routine system behavior. Once deployed, the backdoor enables operators to execute commands remotely, collects system information and manipulates files on compromised machines.

Talos said TernDoor traces its lineage through CrowDoor – a backdoor previously associated with Chinese cyberespionage activity – back to SparrowDoor, an older implant long attributed to Famous Sparrow. To maintain persistence, TernDoor creates a scheduled task and modifies related registry keys to conceal it from standard system views. It also sets a Windows Registry Run key that relaunches the malware at every user login. The implant also installs a malicious Windows driver capable of suspending or terminating processes, a technique that can help attackers evade security monitoring tools.

The second tool, PeerTime, is an ELF-based backdoor designed to run across multiple processor architectures, including ARM, MIPS, PowerPC and AArch64, enabling it to infect a range of Linux servers, routers and embedded systems commonly deployed in telecommunications environments. Talos identified two versions of the implant: one written in C/C++ and a second built in Rust.

Unlike traditional malware that communicates with a centralized command-and-control server, PeerTime uses the BitTorrent protocol to retrieve instructions and download additional payloads from peers. Researchers said this approach helps obscure the attackers’ infrastructure and complicates detection. They said the instrumentor binary accompanying the malware contains debug strings written in Simplified Chinese, a linguistic indicator the researchers said ties the campaign directly to Chinese-speaking operators.

The malware also can disguise its processes as legitimate system programs while executing commands and transferring files between infected systems.

The third component, BruteEntry, is used to convert compromised edge devices into scanning infrastructure – known as operational relay boxes – capable of conducting credential brute-force attacks against exposed services. Written in Go, the tool registers with a command-and-control server and receives lists of IP addresses to probe.

BruteEntry scans for services such as SSH, Postgres and Tomcat and attempts authentication using built-in credential lists. When valid credentials are identified, the information is transmitted back to the attackers’ command infrastructure, with the C2 response indicating whether each brute-force attempt succeeded or failed.

Researchers said the tool effectively turns compromised systems into a distributed scanning network, allowing the attackers to probe large portions of the internet for vulnerable systems and expand their access into additional networks.

The intrusions add to a growing body of reported Chinese espionage activity against telecommunications providers globally. Salt Typhoon, a separate China-linked group, previously compromised at least nine major U.S. carriers and breached systems across more than 80 countries. Researchers identified continued Salt Typhoon activity into early 2026 (see: Norway Says Salt Typhoon Hackers Hit Vulnerable Systems).