Cyber Intruders UAT-5918 Exploit Web Shells Against Taiwan’s Vital Systems

Cyber Intruders UAT-5918 Exploit Web Shells Against Taiwan’s Vital Systems

Summary

• UAT-5918 Identified: Cisco Talos has identified a threat group it tracks as UAT-5918 targeting critical infrastructure in Taiwan.
• Web Shell Tactics: The group exploits known flaws in unpatched web and application servers, then plants web shells for long-term access.
• Key Sectors Threatened: Targets include telecommunications, healthcare and information technology organizations.
• Global Implications: Talos found overlaps with several China-linked groups, including Volt Typhoon and Flax Typhoon.
• Urgent Counteractive Measures: Defenders are urged to patch internet-facing servers and hunt for web shells and tunneling tools.

Who Is UAT-5918?

In March 2025, Cisco Talos published research on UAT-5918, an advanced persistent threat (APT) group it says has been active since at least 2023. Its goal is long-term access to victims’ networks for information theft. Talos said its tools and tactics overlap with several Chinese state-linked groups, including Volt Typhoon, Flax Typhoon, Tropic Trooper and Earth Estries. That points to espionage rather than ordinary cybercrime.

Exploiting Vulnerabilities: The Use of Web Shells

UAT-5918 usually gets in by exploiting known, unpatched vulnerabilities in servers exposed to the internet. Once inside, it drops web shells, small malicious scripts that give an attacker a backdoor on a web server, along with open-source tools for credential theft and network tunneling such as Mimikatz, Impacket and FRP. It then moves through the network and collects data. Web shells are hard to spot. They let attackers come back again and again.

UAT-5918: A Threat to Taiwan and Beyond

The group’s focus on critical infrastructure is the biggest worry. Telecom networks and hospitals in Taiwan matter beyond the island because they connect to global networks and supply chains. Similar techniques have been used by China-linked groups against infrastructure in the U.S. and elsewhere.

Expert Insights and Concerns

Talos’s assessment is that UAT-5918’s activity is consistent with an APT operating with patience and resources, not a financially motivated gang. Overlapping tools and targets with known Chinese groups suggest a shared ecosystem, though Talos did not formally tie the group to a specific government.

For defenders, the takeaway is to treat unpatched web servers as an open door.

Mitigation Strategies: The Road Ahead

The fixes are well known. Patch internet-facing servers quickly. Segment networks so one compromised server does not expose everything. Monitor for new or modified files in web directories, and watch for credential dumping and tunneling tools. International information sharing helps too, since the same groups hit targets in many countries.

The Takeaway

UAT-5918 shows how state-aligned hackers keep exploiting old vulnerabilities to reach critical infrastructure. Taiwan is the current target, but the lesson applies everywhere: fast patching and good monitoring of internet-facing systems remain some of the best defenses.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.