SYMBOLCOMMON_NAMEaka. SYNONYMS

UAT-9921  (Back to overview)

aka: UAT-9921, VoidLink Operator

UAT-9921 is a China-nexus threat actor active since 2019, tracked by Cisco Talos. In 2026, they were observed deploying 'VoidLink', a sophisticated modular framework primarily targeting Linux systems (IoT, Critical Infrastructure). Unique characteristics include the use of AI-enabled IDEs for rapid development (ZigLang implant, GoLang backend), P2P mesh networking for C2, and advanced persistence via eBPF rootkits. They target Technology and Financial sectors exploiting Java serialization vulnerabilities (Apache Dubbo).


Associated Families

There are currently no families associated with this actor.


References
2026-02-11IsovalentJeremy Colvin
Deconstructing Voidlink: Why New AI and Cloud-Native Threats Require a New Class of Defense
VoidLink UAT-9921
2026-02-10Cisco TalosAaron Boyd, Asheer Malhotra, Nick Biasini, Vitor Ventura
New threat actor, UAT-9921, leverages VoidLink framework in campaigns
VoidLink UAT-9921

Credits: MISP Project