UAT-10147 Uses AI to Scale Server Attacks and Deploy Advanced Cross-Platform Malware

Cybersecurity researchers have disclosed details of a Chinese-speaking cybercrime group known as UAT-10147 that is targeting vulnerable Windows and Linux web servers across multiple countries and industries.

The campaign affects organisations in sectors including:

• Education
• Media
• Technology
• Gaming
• Government-related environments

Cisco Talos researchers say the group uses publicly disclosed vulnerabilities to compromise exposed servers at scale and then combines traditional offensive tooling with AI-assisted workflows to accelerate exploitation and post-compromise operations.

Approximately 170,000 URLs Found in Target List

One of the most significant discoveries came from an exposed directory associated with the threat actor's infrastructure.

Researchers found a target list containing approximately 170,000 URLs.

The attackers had divided this list into 17 smaller files containing around 10,000 URLs each, apparently allowing the infrastructure to process large groups of potential targets more efficiently.

This does not necessarily mean that 170,000 servers were successfully compromised.

Instead, the number provides insight into the operational scale of the campaign and how attackers are attempting to industrialize vulnerability exploitation.

The most heavily represented countries in the target list included:

• United States
• India
• United Kingdom
• Germany
• Netherlands

Confirmed victim activity, however, was particularly concentrated in countries including Brazil, Bolivia, China, Canada, and Vietnam.

AI Is Used Across the Attack Lifecycle

The most notable aspect of the campaign is UAT-10147's use of artificial intelligence.

According to researchers, AI-assisted tooling is being incorporated into multiple stages of the attack process, including:

• Reconnaissance
• Exploit development and refinement
• Exploit validation
• Troubleshooting failed attacks
• Payload generation
• Post-exploitation workflows
• Persistence
• Operational documentation

Rather than relying solely on AI to invent completely new vulnerabilities, the group appears to use AI as an operational multiplier.

This allows the attackers to improve existing exploit code, troubleshoot technical problems, and automate repetitive stages of intrusion campaigns.

PentestGPT and DeepAudit

Researchers discovered that the threat actor had installed PentestGPT, an open-source autonomous penetration-testing framework, on command-and-control infrastructure.

The tool was used to scan web servers and execute relevant proof-of-concept exploits against potential targets.

In at least one observed case, the attackers successfully compromised a web server and used Linux commands to collect information about the victim system.

The infrastructure also contained another AI-oriented security tool called DeepAudit.

DeepAudit appears to have been used for vulnerability scanning.

Cisco Talos said it did not find evidence confirming that vulnerabilities discovered by DeepAudit were directly exploited in victim environments.

However, the tool may have been intended to help identify weaknesses in future targets — or potentially to audit the attackers' own infrastructure.

Known Vulnerabilities Used for Initial Access

UAT-10147 primarily relies on already-known vulnerabilities rather than zero-day exploits.

Among the vulnerabilities associated with the campaign are:

• CVE-2022-27925 — Zimbra
• CVE-2021-23758 — AjaxPro
• CVE-2019-18935 — Telerik UI for ASP.NET AJAX
• CVE-2021-29441 — Alibaba Nacos
• CVE-2021-29442 — Alibaba Nacos

Successful exploitation can provide remote code execution on vulnerable web servers.

Once initial access is achieved, automated scripts are used to escalate privileges, install malware, establish persistence, and prepare the compromised host for additional malicious activity.

Windows Attack Chain

On Windows servers, UAT-10147 has been observed using batch scripts to automate several stages of compromise.

Attackers use legitimate Windows utilities such as certutil to download additional payloads.

These may include:

• EfsPotato
• Quasar RAT
• Additional batch scripts
• BadIIS
• SPECTRE

EfsPotato can be used for privilege escalation.

After gaining elevated privileges, the attackers can modify Microsoft Defender exclusions, deploy additional malware, and remove initial payloads to complicate forensic investigation.

The group also creates deceptive scheduled tasks, including one named:

Google Chrome Start

This allows Quasar RAT to persist on compromised Windows systems.

SPECTRE Cross-Platform Backdoor

One of the most advanced components associated with UAT-10147 is a previously undocumented malware family called SPECTRE.

SPECTRE is written in C and supports both Windows and Linux.

The malware communicates with command-and-control infrastructure over HTTPS and includes extensive anti-analysis and remote-control functionality.

Researchers identified up to 45 commands in the Windows version.

Capabilities include:

• File operations
• Keylogging
• Screenshot capture
• Uploading and downloading files
• Shell command execution
• Process enumeration
• Process termination
• System reconnaissance
• Shellcode injection
• Process hollowing
• Early Bird APC injection
• Credential theft
• Timestamp modification
• Self-deletion
• EDR bypass

The first observed use of SPECTRE dates back to approximately April 2026.

SPECTRE Can Blind EDR Products

One of SPECTRE's most dangerous Windows capabilities is its use of Bring Your Own Vulnerable Driver (BYOVD) techniques.

Instead of exploiting the operating system directly, the malware loads legitimate but vulnerable kernel drivers and abuses their privileged access.

The campaign uses vulnerable drivers including:

• MSI RTCore64.sys — CVE-2019-16098
• Dell DBUtil_2_3.sys — CVE-2021-21551

SPECTRE can use these drivers to modify kernel structures associated with endpoint security products.

Researchers say this can effectively remove security callbacks used by EDR platforms to detect:

• New processes
• New threads
• Image loading events

This can significantly reduce visibility for endpoint security products after the system is compromised.

Linux Systems Get a Kernel Rootkit

The Linux version of SPECTRE also provides extensive remote-control capabilities.

It performs anti-sandbox checks before connecting to the attacker's C2 infrastructure.

The malware evaluates characteristics such as:

• RAM size
• Number of CPU cores
• Disk capacity
• Process names
• Sandbox-related usernames
• Hostnames
• Sleep acceleration behaviour

If enough suspicious indicators are detected, SPECTRE terminates itself.

The Linux version supports approximately 29 commands covering:

• File manipulation
• Process reconnaissance
• System reconnaissance
• Shell command execution
• Agent management

Its most powerful component is an integrated kernel-level rootkit called Specter.

Spectre Rootkit Provides Kernel-Level Persistence

The Spectre rootkit is deployed as a Linux kernel module.

Once loaded, it can help the attackers hide malicious activity from user-space security tools and maintain privileged access.

Cisco Talos assesses that portions of the rootkit may have been developed using a combination of AI assistance and human expertise.

Researchers noted characteristics such as:

• Extensive explanatory comments
• Highly structured source code
• Multiple alternative implementations for similar functions
• Consistent formatting

These patterns may indicate AI-assisted code development, although they do not prove that the malware was entirely generated by AI.

Other Malware Used by UAT-10147

SPECTRE is only one component of the group's broader toolkit.

Researchers also observed:

BadIIS
Malware frequently associated with SEO manipulation and malicious traffic redirection.

Quasar RAT
An open-source remote access Trojan commonly used for remote system control.

Noodle RAT
A Linux-focused remote access Trojan associated with several Chinese-speaking threat clusters.

Gh0stCringe
A RAT derived from the Gh0st RAT malware family.

Meterpreter
The post-exploitation payload commonly associated with the Metasploit Framework.

The variety of tools indicates that UAT-10147 is not dependent on a single malware family.

Instead, it combines custom implants, open-source tooling, commodity malware, and AI-assisted workflows.