Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Cisco Talos says a Chinese-speaking threat group it tracks as UAT-7237 breached a Taiwanese web-hosting provider by exploiting unpatched internet-facing servers. The attackers then assessed the provider’s environment and sought durable access to its VPN, cloud and connected enterprise systems—access that could make a hosting company a strategic foothold rather than merely a victim.
What happened to the Taiwanese hosting provider?
In research published August 15, 2025, Cisco Talos described an intrusion by UAT-7237 at an unnamed Taiwanese web-hosting provider. The attackers exploited known vulnerabilities on servers exposed to the internet and not yet patched. After gaining access, they quickly fingerprinted and examined the environment, with particular interest in the provider’s VPN and cloud infrastructure.
Talos says the group uses a mix of open-source and custom tools for reconnaissance, credential theft, malware deployment, remote access and movement through networks. The activity is not limited to web servers: the reported operations included inspecting domain groups, remote hosts, file shares and services, then using recovered credentials and administrative shares to reach additional systems.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Who is UAT-7237?
UAT-7237 is the tracking name Cisco Talos uses for a Chinese-speaking advanced persistent threat (APT) group it says has been active since at least 2022. Talos assesses with high confidence that the group is Chinese-speaking and likely a subgroup of UAT-5918. It tracks UAT-7237 separately because its tools and tradecraft differ in several ways.
#1 Best Overall
- Available with the Cloud Labs which provide a hands-on, immersive mock IT infrastructure enabling students to test their skills with realistic security scenarios
- New Chapter on detailing network topologies
- The Table of Contents has been fully restructured to offer a more logical sequencing of subject matter
- Introduces the basics of network security—exploring the details of firewall security and how VPNs operate
- Increased coverage on device implantation and configuration
| Observed distinction | UAT-7237 | UAT-5918, as described by Talos |
|---|---|---|
| Primary remote-access implant | Cobalt Strike | More reliance on Meterpreter reverse shells |
| Web shells | Used selectively | Relies more heavily on web shells |
| Other access methods | Combines direct RDP access with SoftEther VPN clients | Does not use that same combination as its main approach, according to Talos |
These are Talos’s reported distinctions, not proof that every intrusion by either group follows the same pattern. The assessment that UAT-7237 is Chinese-speaking does not by itself establish who directed a particular operation. Talos’s published account does not provide independently verified evidence of a Chinese government command order.
Why target a web-hosting company?
A hosting provider can be valuable because its operations depend on systems that connect infrastructure, administrative access, cloud services and customer workloads. Talos says UAT-7237 was interested in the victim’s VPN and cloud environment and aimed to establish long-term persistence in high-value environments. Access to a provider’s management systems may therefore offer a strategic foothold beyond the initially compromised server.
That does not mean Talos reported a compromise of every customer site or account. Its account describes an intrusion at one unnamed provider and interest in connected infrastructure; it does not establish how far the attackers reached into customer environments.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- equipped with atom n2600 d2700 processor, compatible with many freebsd based router systems, linux distros, or win.os supported, easy configuration and management
- Please note, this is a barebone only. A system memory, a storage drive and an operating system are needed to complete this system
- 13-19 inches 1u, 50w power, with power cord, make sure to use a big brand memory and ssd/hdd with quality assurance
- Designed with console, 2 x usb, 4 x lan, vga, power switch, size at 290 x 180 x 44mm
- There are 2 inside reserved fans on chassis, which could be removed freely or be turned on in a high temperature environment to ensure the best function of the product
How did the attackers get in and move through the network?
Initial access and reconnaissance
Talos attributes the initial access to known vulnerabilities on unpatched servers exposed to the internet. After entry, the attackers rapidly fingerprinted the environment to assess its value. The published account does not identify a single vulnerability or provide a complete, verified step-by-step chronology for every action.
Remote queries, credential collection and lateral movement
The group used SharpWMI and WMICmd for Windows Management Instrumentation (WMI)-based queries and command execution. It examined domain groups, remote hosts, shares and services while pivoting across the enterprise. For broader discovery, it used FScan to scan IP subnets for open ports and scanned for Server Message Block (SMB) services. Recovered credentials and administrative shares then helped it move to additional systems.
Talos also reports use of JuicyPotato for privilege escalation and command execution. The attackers changed Windows settings to disable a User Account Control restriction and attempted to enable cleartext-password storage through the WDigest UseLogonCredential setting. Credential collection included Mimikatz, dumping the Local Security Authority Subsystem Service (LSASS) process and searching for VNC credentials.
Rank #3
- SonicWall TZ270W Appliance Only - No Service Subscription (02-SSC-2823) - Combines enterprise-grade firewalling with integrated 802.11ac Wave 2 Wi-Fi to deliver secure wired and wireless connectivity in one compact device for small offices and clinics.
- Blocks zero-day threats and ransomware with Capture ATP sandboxing enhanced by RTDMI, plus IPS and anti-malware scanning for layered protection.
- Eliminates the need for separate access points in smaller spaces thanks to built-in high-speed wireless that is simple to deploy and manage.
- Supports VPN, SD-WAN, and TLS 1.3 decryption to secure hybrid cloud access and remote workers while maintaining usability and performance.
- Delivers gigabit performance with up to 750,000 concurrent connections to handle growth in users, devices, and SaaS applications.
What is SoundBill?
SoundBill is a custom shellcode loader written in Chinese, according to Talos. It decodes a file named ptiti.txt and executes the resulting shellcode. Talos says it can load a customized Mimikatz implementation for credential theft, run arbitrary commands or execute a position-independent Cobalt Strike payload.
SoundBill also contains two embedded executables originating from QQ, a Chinese instant-messaging application. Talos says they may serve as decoys; their presence alone does not establish how they were used in this intrusion.
How did SoftEther VPN support persistence?
Talos reports that UAT-7237 used SoftEther VPN clients alongside direct RDP access. A VPN client can provide a remote-access route that is separate from the original vulnerable web server, while RDP can enable direct remote desktop access. Together with selective web shells and Cobalt Strike, these methods gave the attackers multiple ways to retain or regain access.
Rank #4
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
In its analysis of the SoftEther infrastructure, Talos found a remote server created in September 2022 and last used in December 2024. That span indicates the infrastructure may have been used for more than two years; it does not prove uninterrupted activity throughout that period or establish that every UAT-7237 intrusion used the same server.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should hosting providers do now?
Close exposed entry points
- Prioritize patching servers reachable from the internet, especially systems that provide web, VPN or cloud-management access. Track exposed assets so a patch deadline cannot be missed because a server is unknown.
- Inventory every public VPN, RDP and cloud-management path. Remove unnecessary exposure, restrict administration to approved networks and review changes to firewall rules and remote-access services.
- Separate hosting-management systems from customer workloads. Apply least privilege and limit the routes and credentials that can cross between those environments.
Harden accounts and watch for persistence
- Require phishing-resistant multifactor authentication for administrators and other privileged accounts. Protect remote-access accounts separately from ordinary user logins.
- Alert on new or unexpected SoftEther installations, RDP access and WMI execution. Investigate changes to WDigest settings, suspicious LSASS access, Mimikatz-like activity and attempts to enable cleartext credential storage.
- Collect endpoint and network telemetry that can connect remote logins, administrative tool use, credential access and unusual subnet or SMB scanning. Review privileged-account and service changes, not only alerts on web servers.
Prepare to contain a breach
- Practice isolating a compromised server and management plane without losing the ability to operate unaffected hosting services.
- Prepare a credential-rotation plan for administrative, VPN, cloud and service accounts, including a way to invalidate active sessions and investigate reuse of exposed credentials.
- Retain logs for remote access, endpoint activity and cloud administration so responders can establish what was accessed and whether persistence remains after initial containment.
Talos lists Cisco Secure Endpoint, Secure Firewall, Secure Network/Cloud Analytics, Secure Access, Umbrella, Secure Web Appliance and Duo MFA as products that can help prevent, detect or block activity associated with this threat. It also lists Snort v2 rules 64908–64916 and Snort v3 rules 301209–301212. These are vendor-listed options, not a substitute for patching, access controls and an incident-response plan; providers should check current product and rule coverage against their own environment.
What is not established publicly?
Talos does not name the hosting provider, quantify data theft or report financial losses in the account summarized here. It also does not establish that customer data was stolen or that a government directly ordered the operation. Those details should not be inferred from the group’s language assessment, its suspected relationship to UAT-5918 or its interest in infrastructure.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
