Resolutions, shmesolutions (and what’s actually worked for me)
Summary: Cisco Talos disclosed a threat actor it tracks as UAT-7290, active since at least 2022, which conducts espionage-focused intrusions and gains initial access against critical infrastructure entities in South Asia using implants named RushDrop, DriveSwitch, and SilentRaid. The same newsletter also notes two US citizens pleaded guilty to working as ALPHV/BlackCat ransomware affiliates in 2023, and that the European Space Agency confirmed a breach after a hacker offered to sell 200GB of allegedly stolen data.
What you should know: UAT-7290 targets telecom and network infrastructure, which Talos says can have cascading impacts on national security, business operations, and customer data, and its use of publicly available exploits and persistent footholds makes detection and remediation difficult.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026