A previously unknown threat actor, tracked as UAT-9921, has been identified deploying a new modular malware framework called VoidLink in campaigns targeting the technology and financial services sectors. According to Cisco Talos researchers, UAT-9921 has been active since 2019, though the use of VoidLink appears to be a recent development in their operations, indicating a shift in tactics or tools.

The VoidLink framework is described as modular, suggesting it can be adapted for various malicious purposes, potentially enabling more sophisticated and targeted attacks. This activity highlights ongoing threats to critical infrastructure sectors, emphasizing the need for enhanced cybersecurity measures and monitoring to detect and mitigate such advanced threats.

Key Takeaways

  • UAT-9921 is a previously unknown threat actor active since 2019
  • VoidLink is a new modular malware framework used in recent campaigns
  • Targets include the technology and financial services sectors
  • Cisco Talos provided the findings on this threat activity
  • The modular nature of VoidLink may allow for adaptable and sophisticated attacks

Threat Actors

UAT-9921

Source: The Hacker News