Tag: zingdoor

2 Attack Reports | 0 Vulnerabilities

Attack reports

UAT-8302 and its box full of malware

UAT-8302 is a sophisticated China-nexus advanced persistent threat group targeting government entities in South America since late 2024 and southeastern Europe in 2025. The actor deploys multiple custom-made malware families including NetDraft, a .NET-based backdoor variant of FinalDraft/SquidDoor,…
cloudsorcerer
snappybee
finaldraft
vshell
snowlight
deedrat
zingdoor
nosydoor
2026-05-05
draculoader
fringeporch
netdraft
snowrust
squiddoor
Published: May 5, 2026
Linked vulnerabilities : CVE-2025-0994 (CVSS 8.8), CVE-2025-20333 (CVSS 9.9), CVE-2025-20362 (CVSS 6.5)
Downloadable IOCs: 33

ToolShell Used to Compromise Telecoms Company in Middle East

China-based attackers exploited the ToolShell vulnerability (CVE-2025-53770) to compromise a Middle Eastern telecoms company and government agencies in Africa and South America. The attackers deployed malware such as Zingdoor, ShadowPad, and KrustyLoader, which have been associated with Chinese thr…
sliver
shadowpad
krustyloader
toolshell
warlock
2025-10-23
telecoms
zingdoor
Published: October 23, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports