UAT-5918
UAT-5918 is a China-linked threat actor assessed in the provided reporting as a Chinese APT involved in cyber-espionage operations, including targeting Taiwan and Taiwanese critical infrastructure since at least 2023. Cisco Talos describes UAT-5918 as an information-stealing threat actor active since 2023 that uses web shells and open-source tools for persistence and credential theft, and primarily relies on Meterpreter-based reverse shells. After successful compromise, UAT-5918 typically deploys numerous web shells. The group has been reported targeting unpatched servers and has been linked in the content to attacks on Taiwan’s critical infrastructure and to at least one operation against Taiwan using the LapDogs ORB network, although reporting states it is unclear whether UAT-5918 operated LapDogs or was a client of that infrastructure. Talos and other cited reporting note overlaps between UAT-5918 and activity commonly tracked as Volt Typhoon, Flax Typhoon, Earth Estries, and Dalbit. Talos also assesses UAT-7237 is likely a subgroup or division of UAT-5918; compared with UAT-5918, UAT-7237 is described as relying more on Cobalt Strike, selective web shell deployment, and RDP/SoftEther VPN access.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Associated vulnerabilities
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
"The attacks themselves weaponize N-day security vulnerabilities (e.g., CVE-2015-1548 and CVE-2017-17663) to obtain initial access."
"The attacks themselves weaponize N-day security vulnerabilities (e.g., CVE-2015-1548 and CVE-2017-17663) to obtain initial access."
Observables
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Threat actor targeting Taiwan critical infrastructure for long-term access and information theft using web shells and open-source tooling.
China-linked activity cluster referenced as telecom-focused and overlapping with other named China-linked groups; mentioned for similarity/overlap context with UAT-7237.
China-linked activity cluster referenced as telecom-focused and overlapping with other named China-linked groups; mentioned for similarity/overlap context with UAT-7237.
An info-stealing threat actor known for using web shells and open-source tools for persistence and credential theft; Talos assesses UAT-7237 as a subgroup.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.