Cisco Talos Blog: UAT-7237 targets Taiwanese web hosting infrastructure

Aug 15, 2025

—

Source URL: https://blog.talosintelligence.com/uat-7237-targets-web-hosting-infra/
Source: Cisco Talos Blog
Title: UAT-7237 targets Taiwanese web hosting infrastructure

Feedly Summary: Cisco Talos discovered UAT-7237, a Chinese-speaking advanced persistent threat (APT) group active since at least 2022, which has significant overlaps with UAT-5918.

AI Summary and Description: Yes

Summary: The text discusses the activities of UAT-7237, a Chinese-speaking advanced persistent threat (APT) group, and its sophisticated tactics in targeting web infrastructure entities in Taiwan. The report highlights the group’s reliance on customized, open-source tools for long-term persistence and malicious operations, including credential theft and VPN exploitation.

Detailed Description:
The text outlines the operational details and methodologies employed by UAT-7237, emphasizing its classification as an APT focused on web infrastructure. The analysis showcases the group’s reliance on both well-known and customized open-source tools for executing its attacks.

Key points include:

– **Identification of UAT-7237:**
– APT group that has been active since at least 2022.
– Related to another group, UAT-5918, showing significant operational overlaps.

– **Attack Methodologies:**
– **Initial Access:**
– Exploits known vulnerabilities on unpatched servers.
– Uses tools such as reconnaissance scripts (cmd commands) to assess the target.
– **Persistence Techniques:**
– Custom Shellcode loader named “SoundBill” allows for decoding and executing any shellcode, including Cobalt Strike beacons.
– Setups for remote access through SoftEther VPN and RDP (Remote Desktop Protocol).

– **Tools and TTPs:**
– Utilizes various open-source tools and custom malware such as:
– **SoundBill:** Shellcode loader for executing commands and deploying additional malware.
– **JuicyPotato:** For privilege escalation.
– Employs Windows Management Instrumentation (WMI) for remote execution and command execution.

– **Credential Theft and Exfiltration:**
– Uses tools like Mimikatz and customized versions to extract credentials and sensitive information from endpoints.
– Evidence of using multiple attachment methods to deploy malware for credential extraction.

– **Networking Techniques:**
– Conducts network scanning to identify other potentially vulnerable systems within the enterprise environment.

– **Security Recommendations:**
– Cisco security solutions proposed to mitigate threats from such APTs:
– Cisco Secure Endpoint, Secure Email, Secure Firewall, and Secure Access.
– Emphasizes the importance of multi-factor authentication and up-to-date protection against the identified tactics.

Overall, the analysis of UAT-7237 provides critical insights into the evolving tactics of APT groups, highlighting the need for improved defenses in web infrastructure against these sophisticated threats. The implications are significant for security and compliance professionals, who must be informed of such threats to enhance their defensive strategies and protect sensitive organizational data.

1 2 3 5 5918 7 a access Act advanced advanced persistent threat advanced persistent threat (APT) age AI All alt analysis and APT group as at ated attack attack method attack methodologies attacks authentication Bi by C Chinese CI Cisco Cisco Security Cisco Talos class classification co Cobalt Strike code coding Col command command execution compliance compliance professionals credential credential theft credentials critical custom malware customized D data de decoding defense defenses Defensive Strategies Desktop e email end endpoint endpoints enterprise environment ERP execution exfiltration exp exploit Exploitation exploits extraction fact factor authentication firewall focused for g Gen Group H high Highlight hosting HR http HTTPS implications in information infrastructure initial access insights instrumentation Intel intelligence io Iron J k Key known vulnerabilities l least led Li load Loader long low M malware man management methodologies Mimikatz multi multi-factor authentication N network network scanning Networking no o of on ons open open-source open-source tools operation operational operations organization oS OSINT other out over Patch per persistence persistence techniques phi point potential privilege privilege escalation pro professionals protection protocol ps Q R rate RCE RDP re recommendations reconnaissance red remote Remote Access remote desktop remote desktop protocol remote execution report Ro RoT s scanning sec secure secure access security security and compliance security recommendations security solutions sensitive information server servers shellcode Sig size sizes solutions source source tools speaking SSE strategies system systems T tactics Tails Taiwan Talos tech techniques ted text the theft threat threats to tool tools Tor TP two UI up ups US use uth V version VPN vulnerabilities WAN Ware web web hosting web infrastructure Well Wi Wind Windows x z