Loading malware…
SoundBill is a custom shellcode loader tracked by Cisco Talos and used by the Chinese-speaking APT group UAT-7237 in intrusions targeting web infrastructure entities in Taiwan, including a Taiwanese web hosting provider. Talos reports the group has been active since at least 2022 and likely operates as a subgroup of UAT-5918. SoundBill is written in Chinese and is based on VTHello. Its core function is to decode a local file, including ptiti.txt, and load and execute the resulting shellcode. Talos states it can decode and load arbitrary shellcode, including Cobalt Strike payloads, custom Mimikatz functionality, and code enabling arbitrary command execution. The malware has been described as designed to decode and launch secondary payloads such as Cobalt Strike, which UAT-7237 uses as a staple backdoor implant for long-term access. Talos also reported that SoundBill contains two embedded executables originating from QQ, assessed as likely decoy files for spear-phishing lures. Associated activity includes exploitation of known vulnerabilities on unpatched internet-exposed servers for initial access, followed by reconnaissance, credential theft, lateral movement, and persistence via RDP and SoftEther VPN. Related credential-access activity observed in the same operations included LSASS dumping, registry searches for VNC credentials, and attempts to weaken Windows security by enabling WDigest cleartext credential storage and disabling UAC remote restrictions. Talos observed SoundBill-compatible Cobalt Strike beacons communicating over HTTPS to cvbbonwxtgvc3isfqfc52cwzja0kvuqd.lambda-url.ap-northeast-1[.]on[.]aws. The reporting also references attacker infrastructure at 141[.]164[.]50[.]141 and URLs under http[://]141[.]164[.]50[.]141/sdksdk608/ as part of the broader UAT-7237 tool delivery activity.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Talos researchers observed the UAT-7237 APT group using a customized Shellcode loader tracked as “SoundBill.” SoundBill can be employed to decode and load any shellcode, including Cobalt Strike.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
SoundBill has two built-in programs from QQ, a Chinese messaging app, likely used as decoys in phishing attacks.
“…code leading to arbitrary command execution…”
Talos researchers observed the UAT-7237 APT group using a customized Shellcode loader tracked as “SoundBill.” SoundBill can be employed to decode and load any shellcode, including Cobalt Strike.
Credentials are primarily harvested with Mimikatz, sometimes embedded in SoundBill, and through LSASS dumping (Project1.exe) or registry searches for VNC credentials.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.