UAT-7237

UAT-7237 is a Chinese-speaking APT group that has been active since at least 2022, primarily targeting web infrastructure entities in Taiwan. They utilize a customized Shellcode loader known as “SoundBill” to execute shellcode, including Cobalt Strike payloads, and rely on SoftEther VPN clients and RDP for persistence and access. UAT-7237 employs techniques such as credential extraction using Mimikatz, reconnaissance with WMI-based tools, and selective deployment of web shells. Their operations indicate a focus on long-term persistence and stealth, with a preference for open-sourced and customized tooling.

Grubun kökeni Çin olarak bildiriliyor.

Diğer adları: CL-STA-1062

Bu aktör hakkında yayımlanmış raporlar:

• https://blog.talosintelligence.com/uat-7237-targets-web-hosting-infra/
• https://unit42.paloaltonetworks.com/cl-sta-1062-tinyrct-backdoor/

Kaynak: MISP Galaxy, Malpedia.