UAT-7237 targets Taiwanese web hosting infrastructure
Summary: Cisco Talos assesses with high confidence that UAT-7237, a Chinese-speaking APT it considers a likely subgroup of UAT-5918, compromised a Taiwanese web hosting provider and established long-term persistence, with particular interest in the victim's VPN and cloud infrastructure. The group gains initial access by exploiting known vulnerabilities on unpatched internet-facing servers, then uses the SoftEther VPN client for backdoored access, RDP, WMI tooling such as SharpWMI and WMICmd, Mimikatz-based credential extraction, and a custom shellcode loader tracked as SoundBill that decodes a file named ptiti.txt and executes the resulting shellcode.
Key Takeaway: The entry point was known vulnerabilities on unpatched internet-facing servers, and the actor's stated focus was the victim's VPN and cloud infrastructure - the same remote-access layer most organizations rely on to keep attackers out.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026