UAT-5918 targets critical infrastructure entities in Taiwan
Summary: Cisco Talos assesses with high confidence that UAT-5918 is an APT group targeting entities in Taiwan, gaining initial access by exploiting N-day vulnerabilities in unpatched internet-facing web and application servers and then moving manually through compromised enterprises to steal information. The actor deploys web shells across discovered sub-domains and internet-accessible servers, harvests local and domain credentials via Mimikatz, LaZagne, registry hive dumps and browser credential extractors, and pivots using RDP, WMIC and Impacket, with tooling and TTPs overlapping substantially with Volt Typhoon, Flax Typhoon, Earth Estries, Tropic Trooper and Dalbit.
Bottom line: Talos observed UAT-5918 primarily hitting Taiwan's telecommunications, healthcare, IT and other critical infrastructure sectors, and its heavy tooling overlap with Volt Typhoon - which the U.S. government assesses as a PRC state-sponsored actor attacking U.S. critical infrastructure - means the playbook already proven against these targets is not confined to one region.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026