Chinese advanced persistent threat (APT) group UAT-7237 has been actively targeting Taiwan’s web infrastructure and has compromised a Taiwanese web hosting provider using customized open-source hacking tools. The group exploits known vulnerabilities on unpatched servers to infiltrate target systems.
Once a system is compromised, UAT-7237 deploys a custom shellcode loader named SoundBill to gain initial access. Unlike some other groups, UAT-7237 uses a combination of SoftEther VPN clients and Remote Desktop Protocol (RDP) to maintain long-term access to compromised servers. Their toolkit is comprehensive, employing tools like Cobalt Strike for backdoor access and persistent control.
Privilege escalation is a critical part of their strategy, achieved with tools such as JuicyPotato. Credential theft plays a significant role in their methodology, utilizing Mimikatz for extracting credentials and registry searches to gather additional access data.
The tactics, techniques, and procedures (TTPs) used by UAT-7237 indicate they are a subgroup of the larger UAT-5918 entity, with specific strategies including selective web shell deployment. The focus of this group on targeted exploitation and maintaining undetected persistence poses a significant challenge for Taiwanese cybersecurity defenses.

Collections

Chinese APT group UAT-7237 has been targeting Taiwan's web infrastructure using customized open-source hacking tools. The group exploits unpatched vulnerabilities, deploys custom shellcode loaders like SoundBill, and maintains persistence through SoftEther VPN and RDP connections. Their comprehensive toolkit includes Cobalt Strike for backdoor access, JuicyPotato for privilege escalation, and Mimikatz for credential theft, making them a significant threat to Taiwanese cybersecurity defenses.

Chinese APT Group UAT-7237 Targets Taiwan Using Custom Open-Source Hacking Tools