SoundBill

SoundBill is a custom shellcode loader tracked by Cisco Talos and used by the Chinese-speaking APT group UAT-7237 in intrusions targeting web infrastructure entities in Taiwan, including a Taiwanese web hosting provider. Talos reports the group has been active since at least 2022 and likely operates as a subgroup of UAT-5918. SoundBill is written in Chinese and is based on VTHello. Its core function is to decode a local file, including ptiti.txt, and load and execute the resulting shellcode. Talos states it can decode and load arbitrary shellcode, including Cobalt Strike payloads, custom Mimikatz functionality, and code enabling arbitrary command execution. The malware has been described as designed to decode and launch secondary payloads such as Cobalt Strike, which UAT-7237 uses as a staple backdoor implant for long-term access. Talos also reported that SoundBill contains two embedded executables originating from QQ, assessed as likely decoy files for spear-phishing lures. Associated activity includes exploitation of known vulnerabilities on unpatched internet-exposed servers for initial access, followed by reconnaissance, credential theft, lateral movement, and persistence via RDP and SoftEther VPN. Related credential-access activity observed in the same operations included LSASS dumping, registry searches for VNC credentials, and attempts to weaken Windows security by enabling WDigest cleartext credential storage and disabling UAC remote restrictions. Talos observed SoundBill-compatible Cobalt Strike beacons communicating over HTTPS to cvbbonwxtgvc3isfqfc52cwzja0kvuqd.lambda-url.ap-northeast-1[.]on[.]aws. The reporting also references attacker infrastructure at 141[.]164[.]50[.]141 and URLs under http[://]141[.]164[.]50[.]141/sdksdk608/ as part of the broader UAT-7237 tool delivery activity.