UAT-9921

MISP

Type:
Unknown

Country:
CN

First seen:
Unknown

Details:

UAT-9921 is a China-nexus threat actor active since 2019, tracked by Cisco Talos. In 2026, they were observed deploying 'VoidLink', a sophisticated modular framework primarily targeting Linux systems (IoT, Critical Infrastructure). Unique characteristics include the use of AI-enabled IDEs for rapid development (ZigLang implant, GoLang backend), P2P mesh networking for C2, and advanced persistence via eBPF rootkits. They target Technology and Financial sectors exploiting Java serialization vulnerabilities (Apache Dubbo).

References (2)

Aliases (156)

VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator VoidLink Operator

Metadata

ID:	1015
Created:	13/02/2026 16:00
Updated:	02/05/2026 04:00