UAT-6382 is a Chinese-speaking threat actor targeting U.S. local governing bodies, exploiting CVE-2025-0944 on IIS servers.
Analyst brief
UAT-6382 is a Chinese-speaking threat actor primarily targeting local governing bodies in the U.S. They exploit CVE-2025-0944 to deploy web shells like AntSword and chinatso/Chopper on IIS web servers. The actor leverages custom tooling such as TetraLoader and Rust-based loaders to deploy Cobalt Strike and VSHell for persistent, in-memory access. Defenders should prioritize monitoring IIS servers for suspicious web shell uploads, unusual C2 connections (especially to VSHell's hardcoded server), and in-memory execution of Rust-based loaders.
UAT-6382
unknown
UAT-6382 is a Chinese-speaking threat actor that exploits CVE-2025-0944 to gain access to enterprise networks, particularly targeting local governing bodies in the U.S. They deploy web shells like AntSword and chinatso/Chopper on IIS web servers and utilize Rust-based loaders to implement Cobalt Strike and VSHell for persistent access. UAT-6382 employs custom tooling, such as TetraLoader, and conducts reconnaissance to identify and exfiltrate files of interest. Their VShell stager connects to a hardcoded C2 server and executes payloads in memory, indicating modifications made by the actor.