Tomorrow, and tomorrow, and tomorrow: Information security and the Baseball Hall of Fame
Summary: Cisco Talos released research on UAT-5918, a threat actor targeting critical infrastructure entities in Taiwan whose post-compromise tactics, techniques, and procedures overlap most with Volt Typhoon, Flax Typhoon, Earth Estries, and Dalbit intrusions. The group harvests local and domain credentials by dumping registry hives and NTDS and using Mimikatz and browser credential extractors, then moves laterally via RDP, WMIC/PowerShell remoting, or Impacket, using tools including FRPC, FScan, In-Swor, Earthworm, and Neo-reGeorg.
What you should know: UAT-5918's overlap with Volt Typhoon and other named intrusions means the same credential-dumping and living-off-the-land playbook is being reused against critical infrastructure, so IOCs from this campaign are a direct test of whether you can search your own environment across platforms and datasets.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026