UAT-11985 Targets Taiwan Research with Google AitM Phishing via Fake Invites
APT group UAT-11985 uses fake event invites in spear phishing attacks against Taiwan research targets to deploy an adversary-in-the-middle phishing framework targeting Google credentials and MFA codes.
Why it matters
The campaign highlights how sophisticated phishing methods can threaten high-value individuals by circumventing multi-factor authentication, increasing the risk of credential compromise within sensitive research environments.
SOC impact
Investigate phishing attempts involving fake event invitations and monitor for adversary-in-the-middle phishing tactics targeting Google credentials and MFA. Validate accounts linked to Taiwan research organizations for suspicious authentication activities and enrollment behavior.
Recommended actions
- Identify accounts associated with Taiwan research organizations involved in the phishing campaign
- Monitor authentication logs for unusual enrollment or MFA challenges
- Review email filtering and alerting for suspicious event invitations
- Analyze network telemetry for signs of man-in-the-middle interception
- Correlate endpoint activity with phishing indicators related to adversary-in-the-middle techniques
Executive Summary
The advanced persistent threat group UAT-11985 is actively conducting targeted spear-phishing attacks against individuals connected to research organizations in Taiwan. Their method leverages fake Google event invitations to trick targets into engaging with an adversary-in-the-middle phishing framework. This allows attackers to capture Google account credentials alongside multi-factor authentication codes, effectively bypassing security controls designed to protect sensitive access.
This operational approach illustrates how attackers are evolving phishing campaigns to overcome MFA protections, posing a heightened risk to organizations with valuable intellectual property. Security teams should prioritize analysis of authentication behaviors and email invite vetting to detect and mitigate these sophisticated threats.
SOC Impact
Investigate phishing attempts involving fake event invitations and monitor for adversary-in-the-middle phishing tactics targeting Google credentials and MFA. Validate accounts linked to Taiwan research organizations for suspicious authentication activities and enrollment behavior.
Authentication and Access Validation
- Identify accounts associated with Taiwan research organizations involved in the phishing campaign
- Monitor authentication logs for unusual enrollment or MFA challenges
- Review email filtering and alerting for suspicious event invitations
- Analyze network telemetry for signs of man-in-the-middle interception
- Correlate endpoint activity with phishing indicators related to adversary-in-the-middle techniques
Why It Matters
The campaign highlights how sophisticated phishing methods can threaten high-value individuals by circumventing multi-factor authentication, increasing the risk of credential compromise within sensitive research environments.