UAT-5918Threat actor
UAT-5918 is an APT group that targets entities in Taiwan, primarily in telecommunications, healthcare, and IT sectors, to establish long-term access for information theft. They exploit N-day vulnerabilities in unpatched web and application servers to gain initial access and utilize web shells, credential harvesting tools like Mimikatz and LaZagne, and red-teaming tools for post-compromise…From MISP Galaxy
Last reported 3 months ago, by Group-IB1 report
ATT&CK techniques
6 of 21 · each with the sentence it comes from- T1027Obfuscated Files or Information
“Obfuscated Files or Information”
- T1027.013Encrypted/Encoded File
“T1027.013”
- T1036Masquerading
“Masquerading: Match Legitimate Name”
- T1036.005Match Legitimate Resource Name or Location
“T1036.005”
- T1059.005Visual Basic
“T1059.005”
- T1070.004File Deletion
“T1070.004”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake“The hands-on post-exploitation toolkit (iox, fscan, suo5, Neo-reGeorg, etc.) is consistent with Earth Lusca and UAT-5918 operations among others targeting government and education sectors across Asia.”
Indicators in its reports
named in the reports above- 43.106.71[.]28in 1 report
- hxxps://github[.]com/serjs/socks5-serverin 1 report
- hxxps://github[.]com/xmrig/xmrig-proxyin 1 report
- photo.pokok.edu[.]hkin 1 report
- pta.sfaeps.edu[.]hkin 1 report
- sylverixstrategy[.]comin 1 report
- gouvvbo[.]topin 1 report
- 853f760f76de3201b0af0e41f1f65fbain 1 report
- e067ffea77875ae0dc13d4ce045931d3in 1 report
- 8.217.190[.]58in 1 report
- claude-pro[.]comin 1 report
- license.claude-pro[.]comin 1 report
- update-trellix[.]comin 1 report
- 192.252.186[.]62in 1 report
- 104.21.60[.]96in 1 report
- 161.35.236[.]255in 1 report
- vertextrust-advisors[.]comin 1 report
- 178.128.108[.]89in 1 report
- update-crowdstrike[.]comin 1 report
- update-sentinelone[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.