Adversary Intelligence — 2026-05-11

China-Linked Hackers Deploy Three New Implants Against South American Telecom Networks

TernDoor is explicitly identified as a new variant of the previously-disclosed CrowDoor backdoor, itself linked to FamousSparrow and Earth Estries intrusions; its DLL side-loading chain specifically abuses the legitimate wsprint.exe binary to load a malicious BugSplatRc64.dll, after which TernDoor checks for injection into msiexec.exe rather than targeting msiexec.exe as the initial entry point. BruteEntry-compromised edge devices are formally classified as Operational Relay Boxes (ORBs), a term reflecting their role in mass-scanning proxy infrastructure distinct from the implants' primary espionage function.

Analysis
The campaign's architecture, BitTorrent-based C2 and mass-scanning ORB infrastructure, reflects deliberate tradecraft designed to outlast IOC-based defenses. Per a single Talos report, initial access vectors remain unidentified, leaving the attack surface undefined and constraining containment to post-compromise indicators. Multi-platform tooling spanning Windows, Linux, and edge devices signals collection objectives not yet complete. UAT-9244 will very likely expand access within South American telecom networks over the next 12 months. Salt Typhoon's overlapping telco victimology most plausibly reflects distinct mission tasking within China's intelligence apparatus, meaning Salt Typhoon's IOCs and playbooks cannot be assumed to map to UAT-9244 intrusions. The observed South American foothold may instead constitute staging infrastructure for higher-priority North American or European collection.

3 sources

China-Linked Hackers Use TernDoor, PeerTime, BruteEntry in South American Telecom Attacks - The Hacker News
UAT-9244 hits South American telcos with TernDoor, PeerTime and BruteEntry - Threat Intelligence Report
UAT-9244 targets South American telecommunication providers with three new malware implants - Cisco Talos Intelligence Blog