- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- China(high confidence)
- Sources
- 4 sources carry it
- Identifier
- GINC-APT-0602 · uat-9921
ChinaWhat it is
UAT-9921 is a China-nexus threat actor active since 2019, tracked by Cisco Talos. In 2026, they were observed deploying 'VoidLink', a sophisticated modular framework primarily targeting Linux systems (IoT, Critical Infrastructure). Unique characteristics include the use of AI-enabled IDEs for rapid development (ZigLang implant, GoLang backend), P2P mesh networking for C2, and advanced persistence via eBPF rootkits. They target Technology and Financial sectors exploiting Java serialization vulnerabilities (Apache Dubbo).
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- VoidLink Operator
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Tools
The tools and malware families the sources tie to it.
- China Chopper
- Xploit
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de