UAT-8302
UAT-8302 is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets the Government sector.
- Origin
- China
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Oct 1, 2024
- Last seen
- May 1, 2026
- Record updated
Who They Target.
About UAT-8302.
UAT-8302 is a sophisticated China-nexus APT group targeting government entities in South America and southeastern Europe, deploying custom-made malware such as NetDraft, CloudSorcerer version 3, and VSHELL. They utilize tools like SNOWLIGHT and SNOWRUST for initial access and reconnaissance, employing techniques such as PowerShell scripts and SMB share discovery. UAT-8302 also establishes backdoor access through proxy servers and uses tools like Stowaway for tunneling traffic. Their operations indicate a close relationship with other known China-nexus threat actors, leveraging shared malware families and TTPs.
Last updated Oct 9, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.