UAT-10147 Uses AI to Scale Server Attacks—and SPECTRE Can Disrupt Some EDR Visibility

Deck: Cisco Talos says a financially motivated, Chinese-speaking intrusion group is combining known server vulnerabilities, AI-assisted attack workflows, vulnerable Windows drivers and a persistent Linux kernel rootkit.

Reporting cutoff: 2026-08-24T11:37:18Z

Cisco Talos has documented a financially motivated cybercrime operation it tracks as UAT-10147 targeting internet-facing Windows IIS and Linux servers across government, university, media, technology and gaming organizations.^[1]

The campaign matters for two separate reasons:

1. The operators are using AI-oriented tools and AI-generated operational material to make exploitation and post-compromise work easier to repeat at scale.^[1]
2. Their custom SPECTRE implant includes Windows capabilities intended to neutralize some endpoint-detection visibility and a Linux companion rootkit, Specter, that can hide processes and itself at kernel level.^[2]

This is not evidence that AI independently discovered and compromised 170,000 organizations. It is evidence that an established attacker combined known vulnerabilities, open-source offensive tools, custom malware, and AI-assisted workflows to reduce friction and scale operations.

Who is UAT-10147?

UAT-10147 is Cisco Talos’ tracking name for a Chinese-speaking intrusion actor. Talos assesses with moderate-to-high confidence that it is part of an emerging class of financially motivated operators using agentic AI systems to operationalize offensive tradecraft at scale.^[1]

“Chinese-speaking” describes language and development artifacts observed by researchers. It does not by itself establish sponsorship by the Chinese government, the operators’ citizenship or their physical location.

Talos identified affected servers in Brazil, Bolivia, China, Canada and Vietnam. Targeted sectors included government, universities, media, technology and gaming.^[1] The Hacker News separately summarized the Talos disclosure and the same global Windows/Linux server scope.^[6]

Researchers also found an approximately 170,000-URL target list in an exposed directory on attacker-controlled infrastructure. The list had been divided into 17 files of roughly 10,000 URLs each.^[1]

Those are targets, not 170,000 confirmed compromises. Talos documented successful intrusions, but did not publish a complete victim count.

What the attackers want

Talos links UAT-10147 to several financially motivated objectives:

• search-engine-optimization fraud;
• redirection of search visitors;
• deployment of BadIIS and an ASHX SEO engine;
• theft of server and credential information;
• persistent remote access;
• expansion from one compromised web application to additional sites hosted on the same server.^[1][2]

The toolset includes custom malware and familiar offensive frameworks: SPECTRE, Specter, BadIIS, QuasarRAT, Gh0stCringe, Noodle RAT, Meterpreter, Metasploit, ysoserial, “Potato” privilege-escalation tools, web shells, DeepAudit and PentestGPT.^[1][2]

How initial access happens

Talos describes UAT-10147 exploiting publicly known vulnerabilities in exposed web applications and servers; its reports do not identify zero-day exploitation in this campaign.^[1]

The reported initial-access and post-exploitation vulnerability set includes:

• Zimbra exploitation involving CVE-2022-27925;
• CVE-2021-23758 in AjaxPro;
• CVE-2021-29441 and CVE-2021-29442 in Nacos;
• CVE-2019-18935 in Telerik UI for ASP.NET AJAX;
• Linux privilege-escalation flaws CVE-2022-0995, CVE-2021-3156, CVE-2015-5287, CVE-2015-3246, CVE-2010-3904 and CVE-2022-0847;
• vulnerable-driver abuse involving CVE-2019-16098 and CVE-2021-21551.^[1][2]

Six of those 13 identifiers were in CISA’s Known Exploited Vulnerabilities catalog at the cutoff: CVE-2010-3904, CVE-2022-27925, CVE-2022-0847, CVE-2021-3156, CVE-2021-21551 and CVE-2019-18935.^[5]

One attribution detail needs care: Talos summarized CVE-2022-27925 as an unauthenticated Zimbra RCE. CISA describes CVE-2022-27925 as an authenticated arbitrary-file-upload issue and says it was chained with CVE-2022-37042 for unauthenticated RCE.^[5] Administrators should follow the vendor’s complete Zimbra patch guidance rather than treating a single CVE label as the whole chain.

Windows infection chain

After remote code execution, Talos observed automated batch scripts that:

• used Windows-native download utilities to retrieve additional stages;
• deployed EfsPotato for privilege escalation;
• added IIS directories to Microsoft Defender exclusions;
• installed QuasarRAT or other implants;
• removed staging material;
• created a deceptive scheduled task named “Google Chrome Start” for persistence.^[1]

In BadIIS operations, the attackers enumerated IIS site configuration, placed malicious modules in IIS directories, and created a rogue local account with administrator, Remote Desktop and persistent-access privileges.^[1]

Other observed payloads included Gh0stCringe, Meterpreter, web shells and SPECTRE.^[1][2]

Linux infection chain

On Linux, the attacker first obtained code execution on a vulnerable server, deployed a web shell, and then used a broad collection of known local privilege-escalation exploits.^[1]

After reaching root, the operator could deploy Noodle RAT, Meterpreter or SPECTRE for outbound command-and-control access.^[1]

The most serious Linux component is the Specter kernel rootkit included with SPECTRE.^[2]

What SPECTRE can do on Windows

SPECTRE is a custom cross-platform backdoor written in C. Talos counted 45 Windows commands, with capabilities for:

• shell and filesystem operations;
• upload and download;
• process enumeration and termination;
• screen capture and keylogging;
• timestamp modification;
• privilege escalation and token theft;
• process hollowing, APC EarlyBird and shellcode injection;
• in-memory .NET assembly execution;
• dumping Windows registry hives;
• collecting browser-login data;
• loading vulnerable drivers;
• enumerating and unlinking kernel callbacks;
• killing EDR processes and hiding processes.^[2]

SPECTRE also uses layered string/API obfuscation and a weighted anti-analysis system. It checks such characteristics as process names, memory, CPU count, disk space, sleep acceleration and sandbox-like host or user names, then exits when its score reaches a configured threshold.^[2]

How the Windows EDR bypass works

Talos says SPECTRE uses a Bring Your Own Vulnerable Driver, or BYOVD, technique. The implant can download either:

• MSI’s RTCore64.sys, associated with CVE-2019-16098; or
• Dell’s DBUtil_2_3.sys, associated with CVE-2021-21551.^[2]

After loading a vulnerable driver, SPECTRE uses kernel read/write access and a hard-coded offset table covering 13 Windows builds to locate and unlink process, thread and image-load callbacks used by security products.^[2]

Talos says this can blind security products that depend on those callbacks for the remainder of the session.^[2]

That is a serious EDR-evasion capability, but “EDR bypass” should not be interpreted as a guarantee against every security product, Windows build or protection layer. Compatibility, driver blocking, tamper protection, telemetry sources and the product’s architecture all matter.

The Specter Linux rootkit

The Linux SPECTRE variant is a statically linked x86-64 ELF with 29 commands. Its operator can execute shell commands, manipulate files, enumerate processes and interfaces, alter timestamps, load the rootkit, hide processes, elevate to UID 0, hide the module, install persistence and remove the implant.^[2]

Talos found Specter deployed as a loadable kernel module disguised as:

acpi_pad.ko

That name imitates a legitimate ACPI power-management module. Persistence is provided by a fraudulent systemd unit:

hardware-monitor.service

The service’s description is “Hardware Performance Monitor,” and Talos says it is configured to execute before sysinit.target, allowing the rootkit to load early during boot.^[2]

Specter uses the kernel’s legitimate ftrace instrumentation framework to redirect six syscall-related handlers. Its capabilities include:

• hiding a process from /proc;
• hiding the module from lsmod;
• elevating the implant process to UID 0;
• hiding network and directory information;
• communicating through signals sent to a magic PID value of 31337.^[2]

Because it operates at kernel level, a compromised host cannot be considered trustworthy merely because user-space tools report no suspicious process or module.

How much of this was created by AI?

The strongest evidence is not that AI independently ran the entire campaign. It is that UAT-10147 used AI-related tooling and generated material at several practical points.^[1]

Talos observed:

• DeepAudit installed on the management server;
• PentestGPT used to scan web servers and execute relevant public proof-of-concept exploits;
• a detailed AI-generated ASP.NET ViewState exploitation guide;
• scripts for checking writable paths, deploying SPECTRE, deploying a web shell and collecting reconnaissance;
• AI-generated troubleshooting and validation logic;
• operational documentation recording a real intrusion.^[1]

Talos found no evidence that vulnerabilities discovered by DeepAudit had been exploited in victim environments, although it assessed with high confidence that the actor intended to use the framework for source-code or dependency auditing.^[1]

The ViewState workflow also depended on exposed or known ASP.NET MachineKey material. AI did not remove that prerequisite.^[1]

For the Specter rootkit specifically, Talos assessed with medium confidence that its developers combined AI-assisted generation with human expertise. The assessment was based on product-spec-style comments, unusually uniform section formatting, pedagogical explanations and multiple fully documented implementation approaches.^[2]

That is a reasoned code-provenance assessment—not proof of which AI model was used or that every line was generated by AI.

What server administrators should do now

1. Patch the exposed entry points

Inventory every public IIS, Linux, Zimbra, Telerik, Nacos and AjaxPro service. Apply current vendor updates, remove unsupported components and disconnect end-of-life systems. CISA’s KEV catalog should be a minimum-priority signal, not the only patch list.^[5]

2. Hunt for the Windows behaviors

Investigate:

• unexpected Defender exclusions for IIS directories;
• a scheduled task named Google Chrome Start;
• unauthorized administrator or Remote Desktop users;
• unusual use of download utilities by web-worker processes;
• vulnerable RTCore64.sys or DBUtil_2_3.sys drivers;
• transient kernel-driver services;
• SPECTRE configuration stored in an NTFS alternate data stream named hosts:cache;
• saved SAM, SYSTEM or SECURITY hives in temporary directories;
• copied Chrome or Edge login databases;
• IIS modules, ASHX handlers or DLLs not present in a known-good deployment;
• kernel callback changes or visibility gaps that coincide with suspicious driver loading.^[1][2]

3. Hunt for the Linux behaviors

Investigate:

• an unexpected acpi_pad.ko, especially when its hash, path, signature or build does not match the trusted package/kernel;
• hardware-monitor.service with early-boot ordering;
• unknown ftrace hooks or kernel taint;
• differences between /proc, kernel telemetry and external process/network observations;
• hidden or unsigned loadable kernel modules;
• suspicious web shells and altered web-server files;
• unexplained outbound beaconing from web-server processes;
• timestamp changes that do not match deployment records.^[2]

Do not delete a legitimate acpi_pad module based only on its name. Validate the exact path, package origin, signature, hash and running kernel.

4. Do not rely on EDR alone

A kernel-aware attacker may interfere with user-space and callback-based telemetry. Correlate EDR with network, identity, driver, hypervisor, cloud and remote logging. Keep critical logs off the server being monitored.

5. Rebuild when kernel compromise is credible

If a Linux rootkit or Windows kernel-level EDR neutralization is confirmed, isolate the host, preserve evidence, rotate credentials and application secrets from a clean system, and rebuild from trusted media. Simply killing one process or deleting one file is not a sufficient recovery strategy.

6. Use Talos’ IOCs carefully

Cisco Talos published 89 network and SHA-256 indicators across two IOC files.^[3][4] A match is a high-value investigation lead, not standalone proof that UAT-10147 compromised the server. Validate timestamps, context and false-positive risk before blocking or making an attribution; any copied network indicators should remain defanged in reports and tickets.

What remains unknown

The available research does not establish:

• the total number of compromised organizations;
• how many of the 170,000 target URLs were scanned or exploited;
• the actor’s physical location or government sponsorship;
• which AI model produced any specific artifact;
• whether every SPECTRE capability was used against every victim;
• whether the EDR-unlinking implementation works on every current Windows build;
• how many Linux systems received the Specter rootkit;
• the actor’s total revenue from SEO fraud or data theft.

Bottom line

UAT-10147 is dangerous because it combines ordinary weaknesses—unpatched internet-facing servers, exposed keys, vulnerable drivers and overprivileged services—with automation and custom post-compromise tooling.^[1][2]

The defensive lesson is not “AI has made security impossible.” It is that attackers can now package known techniques into faster, better-documented and more repeatable workflows. Closing known exposure, blocking vulnerable drivers, monitoring kernel integrity and rebuilding compromised servers from trusted media remain highly effective defenses.

Safety note: The article does not include exploit payloads, working malicious links, stolen MachineKeys, victim identities or commands that reproduce the attack. Network indicators remain defanged in the separate defensive IOC ledger.

Sources

1. Cisco Talos UAT-10147 AI operations report

   “Talos assesses with moderate-to-high confidence that UAT-10147 is among an emerging class of financially motivated intrusion operators leveraging agentic AI systems to operationalize offensive tradecraft at scale.”

   “From the threat actor’s command-and-control (C2) server open directory, we also identified a target list containing approximately 170,000 URLs stored in a text file.”

   “Once root-level access is achieved, the attacker deploys multiple implants such as NoodleRAT, SPECTRE, and Meterpreter which establish outbound connections to remote command and control infrastructure.”

2. Cisco Talos SPECTRE/rootkit report

   “The newly identified SPECTRE implant represents a significant evolution in commodity intrusion tooling, integrating cross-platform command-and-control (C2) operations, process injection, credential theft, anti-analysis protections, and kernel-level endpoint detection and response (EDR) bypass functionality.”

   “SPECTRE downloads one of two well-known vulnerable driver from the C2 — either RTCore64.sys from MSI (associated with CVE-2019-16098) or DBUtil_2_3.sys from Dell (associated with CVE-2021-21551).”

   “Talos investigated the source code of the Specter rootkit and assesses with medium confidence that UAT-10147 leveraged a combination of AI-assisted development and human expertise in the creation of this rootkit, which is designed to be invoked directly by SPECTRE.”

   “most critical capability is its integrated kernel-level rootkit, called Specter.”

3. Cisco Talos UAT-10147 AI campaign IOCs

   “https[:]//adminapi[.]tippusoni[.]in/4/pr[.]exe https[:]//adminapi[.]tippusoni[.]in/4/prcc2[.]txt https[:]//adminapi[.]tippusoni[.]in/4/prcc2[.]rar”

4. Cisco Talos SPECTRE campaign IOCs

   “https[:]//js[.]jyzyps[.]com/js/vnnb[.]js https[:]//js[.]jyzyps[.]com/js/nb[.]js http[:]//vn[.]mma888[.]cc/”

5. CISA Known Exploited Vulnerabilities catalog

   “Linux kernel contains an improper initialization vulnerability where an unprivileged local user could escalate their privileges on the system. This vulnerability has the moniker of "Dirty Pipe."”

6. The Hacker News UAT-10147 summary

   “Cybersecurity researchers have disclosed details of a Chinese-speaking cybercrime group dubbed UAT-10147 that's targeting Windows and Linux web servers globally across the education, media, technology, and gaming sectors.”