UAT-11985 Uses Event Lures in AitM Phishing Against Taiwan Researchers

Key points

• UAT-11985, described as an APT, targets Taiwan research organizations and associated individuals.
• The campaign uses spear-phishing with event-themed lures and impersonates institutions.
• AitM real-time phishing captures credentials, while AI helps craft lures.
• Cisco Talos and Google reported the findings; no CVE is tied to this activity.

Security researchers at Cisco Talos and Google have tied a credential-harvesting campaign to a threat group tracked as UAT-11985. The activity is described as an advanced persistent threat operation, and it relies on adversary-in-the-middle phishing rather than software exploits. No CVE is associated with the intrusion set, meaning patching alone will not address this vector.

The targets are research organizations in Taiwan and people connected to them. Attackers send spear-phishing messages built around current events, then impersonate legitimate institutions to make the outreach appear trustworthy. When a recipient interacts, the AitM framework relays authentication traffic in real time, allowing the operator to capture credentials and potentially session tokens.

For K-12 and government entities, this matters because the same techniques travel easily. Event-themed lures and institutional impersonation are low-cost, scalable, and hard for users to spot. AI-assisted lure generation can improve grammar, timing, and personalization, increasing the chance a busy employee clicks. Real-time phishing also defeats some legacy MFA prompts by proxying the login flow.

Taiwan's research sector is a recurring focus for state-linked espionage, and the reported overlap with an APT suggests strategic collection rather than opportunistic crime. Cisco Talos and Google published the findings, but no specific malware family or CVE was named in the facts provided. The severity is assessed as medium.

Admins should watch for unexpected MFA prompts, impossible-travel logins, and mail rules that hide replies. Monitor for lookalike domains tied to conferences, grants, or academic events. Treat unsolicited invitations and document shares as suspicious until verified through a separate channel.

What to do now

1. Enforce phishing-resistant MFA such as FIDO2 or WebAuthn for email, VPN, and SSO, prioritizing privileged and research accounts.
2. Configure conditional access to block legacy authentication and flag anomalous token use, impossible travel, and new MFA device registrations.
3. Run targeted awareness for event-themed lures and institution impersonation; teach users to verify through known phone numbers, not reply chains.
4. Deploy email filtering for lookalike domains, newly registered domains, and display-name spoofing; quarantine external event invitations with attachments or links.
5. Hunt for AitM indicators: proxy login pages, unusual user-agent strings, session cookie replay, and mailbox forwarding rules.
6. Restrict OAuth app consent and review third-party app grants; revoke suspicious tokens.
7. Establish a rapid credential reset and session revocation playbook for suspected AitM compromise.

Original source

Cisco Talos