Loading threat actor…
UAT-5918 is a China-nexus espionage threat actor active since at least 2023 and associated with intrusions against critical infrastructure and telecommunications-related targets in Taiwan and elsewhere in Asia. The cluster has been linked by multiple researchers to activity overlapping with Chinese intrusion sets commonly tracked as Volt Typhoon, Flax Typhoon, Earth Estries, and Dalbit, while remaining separately tracked. UAT-5918 has also been observed leveraging Operational Relay Box infrastructure associated with LapDogs in operations targeting Taiwan, although available reporting does not establish that UAT-5918 operates that relay network itself. The actor is characterized as an information-stealing and persistence-focused operator that uses web shells and a hands-on post-exploitation toolkit built heavily from open-source utilities. Reported tooling overlaps include iox, fscan, suo5, and Neo-reGeorg, consistent with operations against government and education targets across Asia. UAT-5918 is known for targeting unpatched servers for initial access, then using web shells and related tooling to maintain footholds, steal credentials, and support follow-on intrusion activity. Reporting also indicates the actor’s objective in Taiwan intrusions has been to establish persistent access inside victim environments rather than conduct disruptive or financially motivated operations. Cisco Talos has documented significant overlap between UAT-5918 and UAT-7237, which it assesses is likely a subgroup or division operating under the broader UAT-5918 umbrella. UAT-7237 differs in tradecraft by relying more heavily on Cobalt Strike, selective web shell deployment, and persistence through RDP and SoftEther VPN, but shares victimology, tooling overlap, and operational timelines with UAT-5918. Separate reporting also notes tooling overlap and infrastructure relationships between UAT-5918 and UAT-7810, another China-nexus cluster assessed to build and maintain ORB relay infrastructure for secondary actors including UAT-5918.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
"The attacks themselves weaponize N-day security vulnerabilities (e.g., CVE-2015-1548 and CVE-2017-17663) to obtain initial access."
"The attacks themselves weaponize N-day security vulnerabilities (e.g., CVE-2015-1548 and CVE-2017-17663) to obtain initial access."
113 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced for TTP overlap with similar Chinese-origin post-exploitation tooling.
Secondary China-nexus actor described as a consumer of ORB infrastructure established by UAT-7810, with tooling overlap but treated as a distinct entity.
Separate China-linked APT that receives infrastructure support from UAT-7810 and has overlapping tooling.
A China-nexus threat actor that leveraged UAT-7810's ORB infrastructure in attacks targeting critical infrastructure entities in Taiwan to establish persistent access.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.