{"id":7428,"date":"2025-08-21T07:45:20","date_gmt":"2025-08-21T11:45:20","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=7428"},"modified":"2025-08-21T03:18:25","modified_gmt":"2025-08-21T07:18:25","slug":"chinese-apt-embeds-in-taiwan-hosting-providers-to-maintain-stealthy-access","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/chinese-apt-embeds-in-taiwan-hosting-providers-to-maintain-stealthy-access\/","title":{"rendered":"Chinese APT embeds in Taiwan hosting providers to maintain stealthy access"},"content":{"rendered":"<p data-start=\"426\" data-end=\"898\"><span id=\"input-sentence~0\">A newly identified cyber campaign is putting Taiwan\u2019s web hosting providers under pressure, with Cisco Talos researchers warning of a group that seems intent on long-term infiltration rather than quick theft.<\/span> <span id=\"input-sentence~1\">The group, tracked as <a href=\"https:\/\/blog.talosintelligence.com\/uat-7237-targets-web-hosting-infra\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">UAT-7237<\/a>, has been active for more than two years and is believed to fall under the wider umbrella of UAT-5918, a cluster tied to several known Chinese advanced persistent threats, including Volt Typhoon and Flax Typhoon.<\/span><\/p>\n<p><span id=\"input-sentence~2\">Investigators say the attackers are not relying on cutting-edge exploits.<\/span> <span id=\"input-sentence~3\">Instead, they are using a blend of familiar techniques and legitimate software to quietly embed themselves.<\/span> <span id=\"input-sentence~4\">Initial access reportedly came through vulnerabilities in exposed servers.<\/span> <span id=\"input-sentence~5\">Once inside, the attackers stuck with Remote Desktop Protocol and <a href=\"https:\/\/www.softether.org\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">SoftEther VPN<\/a> to keep access\u2014pretty much camouflaging their presence as normal admin traffic.<\/span><\/p>\n<p><span id=\"input-sentence~6\">Their toolkit wasn\u2019t one-size-fits-all, either.<\/span> <span id=\"input-sentence~7\">Some tools were standard, straight from the market.<\/span> <span id=\"input-sentence~8\">Among the most notable is <a href=\"https:\/\/threats.wiz.io\/all-tools\/soundbill\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">SoundBill<\/a>, a shellcode loader written in Chinese and linked to QQ messenger files.<\/span> <span id=\"input-sentence~9\">This loader functioned as a highly versatile tool for the attackers, enabling them to deploy a broad spectrum of payloads\u2014from customized Mimikatz binaries to Cobalt Strike modules tailored for command execution and data exfiltration.<\/span><\/p>\n<p data-start=\"426\" data-end=\"898\"><span id=\"input-sentence~10\">They didn\u2019t confine themselves to basic techniques, either.<\/span> <span id=\"input-sentence~11\">Instead, they employed advanced privilege escalation utilities like JuicyPotato (the name\u2019s odd, but the tool is effective) and leveraged network scanners such as Fscan.<\/span><\/p>\n<p><span id=\"input-sentence~12\">Talos analysts highlight that this isn\u2019t just some isolated case.<\/span> <span id=\"input-sentence~13\">It\u2019s part of a broader shift: Chinese-linked threat actors are now blending legitimate software with tried-and-true hacking utilities.<\/span> <span id=\"input-sentence~14\">The whole point?<\/span> <span id=\"input-sentence~15\">To fly under the radar.<\/span> <span id=\"input-sentence~16\">When defenders see normal IT tools mixed in with suspicious activity, it\u2019s way harder to draw a clean line between everyday operations and an actual attack.<\/span><\/p>\n<p><span id=\"input-sentence~17\">And let\u2019s not overlook SoftEther VPN.<\/span> <span id=\"input-sentence~18\">Its use here isn\u2019t random; it\u2019s a pretty clear indicator of intent and sophistication in the attackers\u2019 methods.<\/span> <span id=\"input-sentence~19\">Records suggest the attackers have been running their infrastructure since late 2022, which indicates a patient, methodical approach.<\/span> <span id=\"input-sentence~20\">For hosting providers, that kind of persistence carries a significant risk, since one compromised provider can expose a wide chain of downstream clients.<\/span><\/p>\n<p><span id=\"input-sentence~21\">In the context of Taiwan\u2019s already tense <a href=\"https:\/\/hostingdiscussion.com\/news\/cybersecurity-transformed-over-five-years-as-home-networks-and-ai-shape-risk-landscape\/\">cybersecurity environment<\/a>, the findings highlight how attackers are moving toward operations designed not just for access, but for endurance.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A newly identified cyber campaign is putting Taiwan\u2019s web hosting providers under pressure, with Cisco Talos researchers warning of a group that seems intent on long-term infiltration rather than quick theft. The group, tracked as UAT-7237, has been active for more than two years and is believed to fall under the wider umbrella of UAT-5918, [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[4292,4295,4296,14,4293,4294],"class_list":["post-7428","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-chinese-apt","tag-cisco-talos","tag-cyber-espionage","tag-hosting","tag-taiwan-web-hosting","tag-uat-7237"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Chinese APT embeds in Taiwan hosting providers to maintain stealthy access - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/chinese-apt-embeds-in-taiwan-hosting-providers-to-maintain-stealthy-access\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Chinese APT embeds in Taiwan hosting providers to maintain stealthy access - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"A newly identified cyber campaign is putting Taiwan\u2019s web hosting providers under pressure, with Cisco Talos researchers warning of a group that seems intent on long-term infiltration rather than quick theft. The group, tracked as UAT-7237, has been active for more than two years and is believed to fall under the wider umbrella of UAT-5918, [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/chinese-apt-embeds-in-taiwan-hosting-providers-to-maintain-stealthy-access\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2025-08-21T11:45:20+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-08-21T07:18:25+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/chinese-apt-embeds-in-taiwan-hosting-providers-to-maintain-stealthy-access\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/chinese-apt-embeds-in-taiwan-hosting-providers-to-maintain-stealthy-access\/\",\"name\":\"Chinese APT embeds in Taiwan hosting providers to maintain stealthy access - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2025-08-21T11:45:20+00:00\",\"dateModified\":\"2025-08-21T07:18:25+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/chinese-apt-embeds-in-taiwan-hosting-providers-to-maintain-stealthy-access\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/chinese-apt-embeds-in-taiwan-hosting-providers-to-maintain-stealthy-access\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/chinese-apt-embeds-in-taiwan-hosting-providers-to-maintain-stealthy-access\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Chinese APT embeds in Taiwan hosting providers to maintain stealthy access\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Chinese APT embeds in Taiwan hosting providers to maintain stealthy access - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/chinese-apt-embeds-in-taiwan-hosting-providers-to-maintain-stealthy-access\/","og_locale":"en_US","og_type":"article","og_title":"Chinese APT embeds in Taiwan hosting providers to maintain stealthy access - Web Hosting News","og_description":"A newly identified cyber campaign is putting Taiwan\u2019s web hosting providers under pressure, with Cisco Talos researchers warning of a group that seems intent on long-term infiltration rather than quick theft. The group, tracked as UAT-7237, has been active for more than two years and is believed to fall under the wider umbrella of UAT-5918, [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/chinese-apt-embeds-in-taiwan-hosting-providers-to-maintain-stealthy-access\/","og_site_name":"Web Hosting News","article_published_time":"2025-08-21T11:45:20+00:00","article_modified_time":"2025-08-21T07:18:25+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/chinese-apt-embeds-in-taiwan-hosting-providers-to-maintain-stealthy-access\/","url":"https:\/\/hostingdiscussion.com\/news\/chinese-apt-embeds-in-taiwan-hosting-providers-to-maintain-stealthy-access\/","name":"Chinese APT embeds in Taiwan hosting providers to maintain stealthy access - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2025-08-21T11:45:20+00:00","dateModified":"2025-08-21T07:18:25+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/chinese-apt-embeds-in-taiwan-hosting-providers-to-maintain-stealthy-access\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/chinese-apt-embeds-in-taiwan-hosting-providers-to-maintain-stealthy-access\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/chinese-apt-embeds-in-taiwan-hosting-providers-to-maintain-stealthy-access\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"Chinese APT embeds in Taiwan hosting providers to maintain stealthy access"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":226,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/7428","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=7428"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/7428\/revisions"}],"predecessor-version":[{"id":7430,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/7428\/revisions\/7430"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=7428"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=7428"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=7428"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}