A Chinese-speaking advanced persistent threat (APT) group known as UAT-7237 has been identified as targeting Taiwanese web infrastructure using a combination of customized open-source tools. According to a report by Cisco Talos, UAT-7237 has been active since at least 2022 and is believed to be a subgroup of another APT, UAT-5918, which has targeted critical infrastructure in Taiwan as early as 2023. The group has shown a particular interest in accessing VPN and cloud infrastructures, as indicated by their configuration of the SoftEther VPN client, which specifies Simplified Chinese as the preferred display language.
The attacks executed by UAT-7237 are characterized by the use of a bespoke shellcode loader named SoundBill. This loader is designed to decode and launch secondary payloads, including Cobalt Strike, which has been identified as their primary backdoor implant. The exploitation process typically begins with attacks on unpatched servers, utilizing known vulnerabilities in public-facing applications. Talos noted that 'the core functionality of the backdoor remains the same but we did notice some changes in the implementation and the configuration of the backdoor.'
Notably, UAT-7237’s tactics exhibit differences from UAT-5918, particularly in their selective deployment of web shells post-compromise. This group is more focused on achieving long-term access rather than deploying numerous web shells across various endpoints. Cisco Talos remarked that UAT-7237 relies heavily on open-source tooling that has been customized to evade detection while conducting malicious activities within compromised environments. 'UAT-7237 conducted a recent intrusion targeting web infrastructure entities within Taiwan,' the report stated.
In response to the ongoing threat posed by UAT-7237, security teams are enhancing their monitoring capabilities. Vendors are advised to ensure that all systems are patched and updated to mitigate potential vulnerabilities. Expert analysis indicates that organizations should review their firewall configurations and access controls to guard against unauthorized entry through exploited VPNs and cloud services. As UAT-7237 continues to evolve, the importance of proactive security measures cannot be overstated. Security teams are urged to remain vigilant and adapt their defenses in light of these sophisticated threat actors.
