China-Linked UAT-8302 APT Targets Governments in South America and Europe

A China-nexus advanced persistent threat (APT) group, tracked by Cisco Talos as UAT-8302, is actively targeting government entities. The Hacker News reports that attacks have hit South American government entities since late 2024, extending to government agencies in southeastern Europe in 2025. This group demonstrates a persistent, geographically diverse targeting strategy.

Post-exploitation, UAT-8302 deploys custom-made malware families, indicating a tailored approach rather than off-the-shelf tools. The use of shared APT malware across regions suggests a centralized development and operational structure, allowing the group to leverage proven tactics and tools against varied targets. This efficiency reduces development overhead and increases the speed of deployment.

This campaign underscores the persistent threat of state-sponsored espionage. Targeting government agencies in distinct geopolitical regions suggests intelligence gathering is the primary objective, rather than financial gain. The long-term nature of these campaigns, spanning across years, highlights the strategic patience and resourcefulness of such actors.