Security researchers have disclosed details of UAT-10147, a Chinese-speaking cybercrime group that targets Windows and Linux web servers across multiple industries, including education, media, technology, and gaming. The reporting highlights how the attackers blend automation with AI-powered tooling to expand operational scale while pursuing data theft and SEO fraud.
While victims appear worldwide, the largest concentration mentioned in the analysis is in Brazil, Bolivia, China, Canada, and Vietnam. The investigation started after an open directory hosted at 139.180.197[.]150 was observed communicating with one of the compromised systems.
Overall, the campaign illustrates a modern pattern: attackers use AI and publicly known offensive resources to streamline the path from initial access to persistence. In this case, that approach culminates in the deployment of a cross-platform backdoor called SPECTRE.
How AI scales server attacks in the intrusion workflow
UAT-10147 is described as using AI-backed tools at different stages of an attack lifecycle. Rather than only relying on manual exploitation, the group uses AI-oriented assistance to speed up and refine key activities such as exploitation planning, reconnaissance, payload preparation, validation, and the creation of operational documentation.
Researchers note that the use of AI appears aimed at applying offensive “tradecraft” at scale. For defenders, the important takeaway is not that AI is magic, but that it can reduce friction and time across steps that otherwise slow down intrusions.
Target list, automation, and a broad global footprint
One notable artifact came from analyzing the exposed directory. Investigators found a text file containing a target list with roughly 170,000 URLs. The attackers reportedly split the list into 17 smaller files of about 10,000 URLs each to help parse targets more efficiently.
According to the analysis, the most common destinations among the listed targets were the United States, India, the United Kingdom, Germany, and the Netherlands. That distribution aligns with the campaign’s global scanning behavior.
Exploitation chains: from known flaws to malware deployment
The disclosed attack chains generally follow a common structure. The group uses publicly known vulnerabilities to gain remote code execution (RCE) against a website or a vulnerable IIS server. After that, an automated script installs and deploys malware intended for SEO fraud and data theft.
In some cases, the attackers deploy a web shell, which then enables additional components such as BadIIS and other backdoors to maintain long-term access.
Windows-side follow-on steps
The reports outline multiple procedural actions taken after initial execution, including staged downloads and privilege escalation. Examples mentioned include:
- Using a batch script with certutil to download a privilege escalation tool named EfsPotato, a secondary batch script, and Quasar RAT from a remote server (adminapi.tippusoni[.]in).
- Running EfsPotato to obtain elevated privileges and configuring Microsoft Defender exclusions.
- Deleting initial payloads to reduce evidence and complicate forensic analysis.
- Deploying follow-on implants such as Gh0stCringe and the cross-platform backdoor SPECTRE.
- Using a deceptive scheduled task titled “Google Chrome Start” to silently execute Quasar RAT and establish persistence.
- Downloading yet another batch script with elevated privileges to install BadIIS.
Researchers also highlight that the core BadIIS malware matches a specific variant known to operate under a malware-as-a-service (MaaS) model, used by multiple Chinese-speaking groups.
Linux intrusions: privilege escalation to root and backdoor deployment
On Linux systems, UAT-10147 follows a similar “gain access, then escalate” approach. The group leverages known vulnerabilities to obtain an initial foothold, then abuses multiple Local Privilege Escalation (LPE) exploits to reach root.
The disclosed LPE exploits include CVE entries such as CVE-2022-0995, CVE-2021-3156, CVE-2015-5287, CVE-2015-3246, CVE-2010-3904, and CVE-2022-0847.
After root-level access is achieved, the attackers have been observed deploying multiple backdoors, including variants such as Noodle RAT (described as related to Gh0st RAT and Rekoobe), SPECTRE, and Meterpreter to enable communications to remote command-and-control (C2) infrastructure.
Linux and Windows vulnerabilities mentioned in the campaign
Among the vulnerabilities listed as weaponized during the campaign are issues affecting products and services such as Zimbra (CVE-2022-27925), AjaxPro (CVE-2021-23758), Telerik UI for ASP.NET AJAX (CVE-2019-18935), and Alibaba Nacos (CVE-2021-29441 and CVE-2021-29442), plus CVE-2021-29441/29442 referenced as part of Nacos activity.
Stealth considerations: blending exfiltration with legitimate services
One operational detail relates to exfiltration behavior. Investigators report that exfiltrated data was routed through a legitimate cloud-based configuration management service. This design is intended to make attacker traffic resemble normal administrative operations.
Because the attackers can poll their own Nacos instance to confirm exploitation results across victims, they avoid the overhead and detection risk associated with maintaining direct inbound connections or persistent reverse shells.
DeepAudit and AI-assisted scanning: evidence gaps and defensive relevance
A key point in the disclosure is the presence of an AI-driven vulnerability scanning framework called DeepAudit. Talos reports that it found no evidence the threat actor exploited vulnerabilities discovered by the tool inside victim environments.
That absence raises two plausible interpretations. The attackers might have intended to use DeepAudit later to identify weaknesses in targeted environments. Alternatively, the tool could also be used to audit their own infrastructure and internal tooling, reducing exposure to other threat actors or unintended compromise.
Either way, the same lesson applies: AI-enabled scanning and validation can support both offense and security review behaviors, which makes it harder for defenders to assume “tool presence” equals “active exploitation.”
PentestGPT and exploit guidance generation
Another AI-oriented component referenced in the report is PentestGPT, an open-source autonomous pentesting framework. Investigators state it was installed on the C2 server to scan web servers and attempt proof-of-concept exploits.
In at least one described incident, the attackers reportedly exploited a website and collected information about the victim host using Linux commands.
SPECTRE: cross-platform backdoor with EDR bypass and rootkit capabilities
The campaign’s most consequential element is SPECTRE, a cross-platform backdoor written in C. Researchers describe it as obfuscated, anti-analysis oriented, and designed to evade detection. It communicates with the C2 server over HTTPS and can support up to 45 commands to control infected endpoints.
Talos also notes that the first observed use of the implant dates back to April 2026, and frames the discovery as an evolution in commodity intrusion tooling.
Windows features and EDR callback tampering
On Windows, SPECTRE includes capabilities such as file operations, keystroke recording, screenshots, file download/upload, command execution, process discovery, and the ability to terminate a specific process. It can also inject shellcode using techniques like process hollowing and Early Bird APC injection.
A particularly disruptive feature is the ability to impair endpoint detection and response. The report attributes the EDR bypass approach to a “bring your own vulnerable driver” (BYOVD) method using vulnerable drivers referenced as:
- RTCore64.sys (CVE-2019-16098)
- DBUtil_2_3.sys (CVE-2021-21551)
With targeted kernel writes, the malware reportedly unlinks registered EDR callbacks from internal lists. The result is that security products become blind to new process and thread creations and image load events for the remainder of the session.
Linux variant: sandbox checks and a kernel-level rootkit
On Linux, SPECTRE reportedly follows a similar behavioral pattern, including anti-sandbox checks before establishing its C2 connection. Both versions use a weighted scoring mechanism and self-terminate if the score crosses a threshold (reported as 50 points).
The scoring is based on factors such as process name blocklists, available RAM, CPU core count, disk space, sleep acceleration detection, and common sandbox hostnames and usernames. The Linux instruction set is described as supporting fewer commands (29 total) focused on filesystem operations, reconnaissance, agent management, and shell execution.
Most importantly, the Linux implant can deploy a kernel-level rootkit called Specter as a kernel module. Investigators suspect it may have been developed using a mix of AI-assisted generation and human expertise, partly because of descriptive comments and multiple methods to accomplish the same function.
Why this matters for organizations running web services
Even without access to the attacker’s full playbook, the disclosed details map to risk areas that many organizations share: internet-facing services, exposed management components, and uneven patch coverage across web stacks.
Because UAT-10147 combines automated exploitation steps with AI-assisted components for scanning, validation, and operational documentation, the time window for detection shrinks. In practice, attackers may iterate faster—moving from target identification to exploitation and persistence with less manual overhead.
Conclusion: AI-enabled automation raises the bar for detection
The disclosure of UAT-10147 underscores that AI scales server attacks not by replacing every step with “intelligence,” but by accelerating the workflow around reconnaissance, exploit refinement, validation, and follow-through. The addition of SPECTRE—complete with EDR bypass behaviors on Windows and a kernel-level rootkit on Linux—shows how far commodity intrusion tooling can evolve.
For defenders, the actionable mindset is to assume rapid automation: focus on patching known vulnerable components, monitoring for suspicious post-exploitation patterns, and validating that EDR visibility remains intact even when attackers attempt kernel-level interference.
Source: https://thehackernews.com/2026/08/uat-10147-uses-ai-to-scale-server.html
