Listen to this Post
Introduction: The Attackers Are Automating More Than Ever
Cybercrime is entering a more dangerous and increasingly automated phase. The discovery of UAT-10147, a Chinese-speaking cybercrime group targeting vulnerable Windows and Linux web servers around the world, offers a troubling look at how traditional exploitation techniques are being combined with artificial intelligence, open-source offensive frameworks, custom malware, and large-scale automation.
This is not simply a story about another threat actor scanning the internet for vulnerable servers. UAT-10147 appears to represent a broader transformation in offensive cyber operations. Publicly known vulnerabilities are being weaponized at scale, AI-powered tools are being incorporated into reconnaissance and exploitation workflows, and compromised systems are being converted into platforms for SEO fraud, data theft, persistence, and deeper intrusion.
According to the reported findings, the group has targeted organizations across education, media, technology, and gaming, with victims concentrated in several countries while its enormous target infrastructure spans hundreds of thousands of URLs.
The most alarming element may be the combination of scale and adaptability. A threat actor no longer needs to manually perform every stage of an intrusion. Automated scripts can scan targets, validate vulnerabilities, deploy payloads, escalate privileges, establish persistence, and collect information. AI-assisted tools may further reduce the time and expertise required to move from an exposed vulnerability to an operational compromise.
The result is an increasingly industrialized model of cybercrime.
The Discovery: An Open Directory Revealed the Operation
The activity surrounding UAT-10147 came to light after researchers discovered an exposed directory hosted on infrastructure that had communicated with one of the compromised systems.
Inside that environment, researchers uncovered evidence of an organized intrusion ecosystem rather than a single isolated attack. One particularly significant discovery was a target list containing approximately 170,000 URLs.
Instead of processing the entire collection as one massive dataset, the attackers reportedly divided it into 17 smaller files containing roughly 10,000 URLs each. That detail may seem minor, but it provides an important glimpse into the operational mindset behind the campaign.
The attackers were apparently preparing their infrastructure for scale.
The largest destinations represented in the target list included the United States, India, the United Kingdom, Germany, and the Netherlands.
A list of this size changes the nature of the threat. Rather than carefully selecting a handful of organizations, an automated operation can repeatedly search for vulnerable infrastructure across a massive pool of potential victims.
The Initial Access Strategy: Exploiting What Is Already Known
UAT-10147 reportedly relied heavily on publicly disclosed vulnerabilities to gain initial access.
This is one of the most important lessons from the campaign.
Attackers do not always need previously unknown zero-day vulnerabilities when thousands of systems remain exposed to flaws that already have patches, public advisories, proof-of-concept exploits, or well-documented attack paths.
The reported attack chains included exploiting vulnerabilities capable of producing remote code execution against websites and vulnerable IIS servers. Once access was obtained, automated scripts could install additional malware designed for SEO fraud or data theft.
In selected cases, the attackers deployed web shells and used them as stepping stones for persistent access and additional malware deployment, including BadIIS.
This approach demonstrates why vulnerability management remains one of the most important defensive controls in cybersecurity. The danger is often not a vulnerability existing somewhere in a software product. The danger is the period between public disclosure and complete remediation.
For automated threat actors, every unpatched server can become another candidate in a global attack pipeline.
The Windows Attack Chain: From Initial Access to SYSTEM-Level Control
The reported Windows activity involved multiple stages designed to transform initial access into deeper and more persistent control.
One batch script reportedly used certutil to retrieve additional components, including the EfsPotato privilege escalation tool, a secondary batch script, and Quasar RAT.
EfsPotato was then used to obtain elevated privileges, after which the attackers could configure Microsoft Defender exclusions.
This was followed by efforts to remove initial payloads, making forensic analysis more difficult.
The campaign also deployed additional implants, including Gh0stCringe and the previously unreported cross-platform malware known as SPECTRE.
Persistence was reportedly established through Quasar RAT using a deceptive scheduled task named “Google Chrome Start,” an example of attackers using familiar-looking names to make malicious activity less conspicuous during basic inspection.
The use of several tools within the same intrusion is significant.
Modern attackers often do not depend on a single piece of malware. Instead, they build chains of tools, scripts, privilege escalation techniques, remote access implants, and persistence mechanisms.
If one component fails or is detected, another may remain available.
BadIIS and the SEO Fraud Connection
One of the notable malware families associated with the campaign is BadIIS.
The malware reportedly deployed by UAT-10147 corresponds to a variant associated with a malware-as-a-service model and used by multiple Chinese-speaking cybercrime groups.
This illustrates another important development in the underground ecosystem.
Cybercriminals do not necessarily need to develop every tool themselves.
Malware services, leaked code, open-source frameworks, public exploit repositories, and reusable implants can dramatically reduce the resources needed to launch a sophisticated campaign.
A compromised web server can therefore become more than a machine for stealing information.
It can potentially be turned into infrastructure for manipulating search results, redirecting visitors, hosting malicious content, or supporting broader fraud operations.
The compromise of a web server can consequently create risks that extend beyond the organization itself.
Its customers, visitors, partners, and search reputation may also be affected.
Linux Servers Were Targeted With a Familiar Formula
The Linux side of the campaign followed a similar overall philosophy.
Known vulnerabilities were reportedly exploited to gain an initial foothold, after which local privilege escalation exploits were used in attempts to obtain root-level access.
The vulnerabilities mentioned in the reported activity include CVE-2022-0995, CVE-2021-3156, CVE-2015-5287, CVE-2015-3246, CVE-2010-3904, and CVE-2022-0847.
Once root access was obtained, the attackers could deploy backdoors including Noodle RAT, SPECTRE, and Meterpreter.
Additional vulnerabilities reportedly weaponized during the broader campaign included flaws affecting Zimbra, AjaxPro, Telerik UI for ASP.NET AJAX, and Alibaba Nacos.
The presence of older vulnerabilities in the reported attack chain is especially revealing.
Age does not automatically make a vulnerability irrelevant.
An old flaw can remain highly valuable when an exposed system was never patched, was forgotten, or exists within an environment where legacy software cannot easily be replaced.
Hiding Data Exfiltration Inside Legitimate Infrastructure
One of the more sophisticated aspects of the reported operation involves how stolen information could be handled.
Researchers described the use of a legitimate cloud-based configuration management service as an asynchronous location for verifying successful exploitation and handling exfiltrated information.
Instead of relying entirely on a conventional reverse shell or maintaining direct inbound connections, the attackers could blend some of their activity into infrastructure that may appear more consistent with legitimate administrative operations.
This creates an important detection challenge.
Security teams often search for obviously suspicious destinations, unusual command-and-control servers, or malicious network signatures.
However, abuse of legitimate cloud platforms and web services can complicate that process.
Traffic may use normal HTTPS connections.
The destination may be a legitimate service.
The malicious behavior may therefore be hidden within an otherwise trusted communication channel.
Defenders increasingly need to evaluate behavior, context, identity, and unusual patterns rather than relying only on whether a destination is already known to be malicious.
AI Is Becoming Part of the Attacker Workflow
Perhaps the most attention-grabbing aspect of UAT-10147 is its reported use of AI-oriented and AI-assisted tooling.
The actor was observed using or maintaining tools such as DeepAudit and PentestGPT alongside other offensive frameworks including Metasploit and ysoserial.
The reported activity suggests that AI-powered tools could assist with exploit refinement, troubleshooting, reconnaissance, validation, post-exploitation workflows, payload generation, and operational documentation.
This does not necessarily mean that artificial intelligence independently performs an entire intrusion without human involvement.
The more realistic danger is that AI reduces friction.
Tasks that once required extensive manual research may become faster.
Scripts may be generated more quickly.
Errors may be easier to troubleshoot.
Attack workflows may become easier to document and repeat.
Operational knowledge can potentially be transformed into reusable automated processes.
That is where the real strategic change may be occurring.
AI does not need to become a fully autonomous hacker to increase cyber risk.
It only needs to make human attackers faster.
DeepAudit and PentestGPT Reveal Different Possibilities
DeepAudit was reportedly present as part of the infrastructure associated with UAT-10147.
Researchers did not find evidence that vulnerabilities identified by the framework were directly exploited against victims in the observed environments.
However, its presence raised the possibility that the attackers could be preparing to use it for vulnerability discovery or potentially for evaluating their own infrastructure and tooling.
PentestGPT was also reportedly installed on a command-and-control server and used in connection with scanning web servers and executing relevant proof-of-concept exploits.
In at least one reported case, a successfully compromised website was followed by information collection using Linux commands.
These findings are important because they show that AI tools do not necessarily replace conventional offensive security tools.
Instead, they can sit alongside them.
The future attacker toolkit may include vulnerability scanners, exploit frameworks, command-line tools, AI assistants, custom scripts, malware loaders, and cloud infrastructure operating together as one workflow.
ViewState Exploitation Was Turned Into an Operational Playbook
Another component of the reported operation involved an ASP.NET ViewState deserialization remote code execution guide.
The process reportedly involved using publicly known or leaked ASP.NET MachineKey configurations, validating keys, generating malicious deserialization payloads, bypassing ViewState protection, and ultimately achieving code execution.
Following code execution, the documented workflow included systematic reconnaissance through PowerShell.
The attackers could collect system information, privilege details, web directories, IIS configurations, network interface information, and running process data.
The information could then be transmitted to a remote webhook.
The same workflow included persistence through SPECTRE, an ASHX web shell, or a PowerShell reverse shell.
Privilege escalation techniques could then be used to move from an IIS AppPool identity toward SYSTEM-level privileges.
What makes this concerning is not simply the exploitation technique.
It is the apparent attempt to transform exploitation knowledge into a repeatable procedure.
A documented playbook can be reused.
Automation can be attached to it.
AI can potentially help troubleshoot it.
That combination can make an operation more scalable than a manually executed intrusion.
AI-Generated Scripts Added Another Layer of Automation
The reported infrastructure also contained several Python scripts associated with the operational workflow.
One acted as a post-exploitation diagnostic utility intended to troubleshoot problems such as web shell write failures.
Another used the ViewState deserialization technique to download and launch SPECTRE.
A third deployed an ASHX web shell onto a compromised IIS server.
The final script focused on blending exfiltration traffic with legitimate SaaS traffic over HTTPS while transmitting enumeration and privilege assessment information to a webhook endpoint.
These scripts demonstrate how automation can connect individual stages of an attack.
Reconnaissance can feed exploitation.
Exploitation can trigger payload delivery.
Payload delivery can establish persistence.
Persistence can enable data collection.
Data collection can be transmitted through infrastructure designed to appear less suspicious.
When these stages are connected through automation, the speed of an intrusion can increase dramatically.
SPECTRE Emerges as the
The newly reported SPECTRE implant represents one of the most technically significant elements associated with UAT-10147.
According to the reported analysis, SPECTRE is a cross-platform backdoor written in C and designed with obfuscation and anti-analysis capabilities.
It communicates with its command-and-control infrastructure using HTTPS and supports dozens of commands that provide extensive control over an infected system.
Its first reported use by the threat actor dates back to April 2026.
On Windows, SPECTRE reportedly supports file operations, keystroke recording, screenshots, file transfers, shell command execution, process inspection and termination, system information collection, beacon control, timestamp modification, shellcode injection, process hollowing, and Early Bird APC injection.
The malware was also reported to support techniques designed to interfere with endpoint detection and response products, including the use of vulnerable drivers in a BYOVD technique.
This is a major escalation from simple web shells or basic remote access malware.
A compromised server can potentially become a platform for persistent surveillance, credential theft, deeper movement, and defense evasion.
Vulnerable Drivers Can Become Weapons Against Security Software
The reported Windows activity involved two known vulnerable drivers, MSI’s RTCore64.sys and Dell’s DBUtil_2_3.sys.
These drivers were associated with CVE-2019-16098 and CVE-2021-21551.
The reported technique attempts to leverage vulnerable legitimate drivers to obtain elevated capabilities and interfere with security-related processes.
This type of technique demonstrates an uncomfortable reality in endpoint security.
Software and drivers that were originally designed for legitimate purposes can sometimes become part of an attack chain when known vulnerabilities remain exploitable.
The reported SPECTRE functionality went further by targeting kernel-level callback mechanisms used by security products for visibility into events such as process creation, thread creation, and image loading.
The lesson for defenders is that endpoint security cannot operate as an isolated layer.
Driver management, vulnerability remediation, application control, privilege restrictions, and behavioral monitoring all matter.
The Linux Version Introduced a Kernel-Level Rootkit
SPECTRE’s Linux variant reportedly follows a similar structure while including its own anti-analysis checks.
The malware evaluates characteristics such as process names, memory capacity, CPU cores, disk space, sleep behavior, host names, and usernames.
A weighted scoring mechanism reportedly causes the malware to terminate itself if the environment appears sufficiently suspicious.
The Linux version supports fewer commands than the Windows variant but retains powerful capabilities involving file system manipulation, reconnaissance, agent management, and unrestricted shell execution.
Its most significant feature is an integrated kernel-level rootkit called Specter, which can be deployed as a kernel module.
Kernel-level persistence creates a fundamentally different security challenge.
The deeper malware operates within the system, the more difficult detection and removal can become.
A compromise is no longer just about deleting a suspicious executable.
Security teams may need to determine whether the operating system, kernel modules, credentials, persistence mechanisms, and surrounding infrastructure can still be trusted.
Human Expertise and AI Assistance May Be Merging
Researchers noted characteristics suggesting that the Specter rootkit may have been developed through a combination of AI-assisted development and human expertise.
The source code reportedly contained descriptive comments, uniform decorative separators, and multiple methods for accomplishing similar tasks.
These characteristics were considered consistent with patterns sometimes produced by AI systems when asked to generate thorough implementations.
This is an important observation, but it should not be misunderstood.
AI assistance does not eliminate the role of skilled operators.
Instead, it may allow experienced developers and attackers to accelerate development, generate alternatives, document code, troubleshoot problems, and explore implementation options more quickly.
The future threat landscape may therefore be shaped by a hybrid model.
Humans provide strategic direction and specialized expertise.
AI assists with scale, iteration, coding, troubleshooting, and documentation.
Automation connects everything together.
What Undercode Say:
The Real Threat Is Not AI Alone
The biggest mistake would be to look at UAT-10147 and conclude that AI itself is the entire problem.
AI is only one component of the reported operation.
The more serious issue is the combination of AI, automation, publicly available exploits, open-source frameworks, malware services, vulnerable infrastructure, and large-scale target discovery.
Attackers Are Building Production Pipelines
This campaign resembles an industrial workflow more than a traditional one-off intrusion.
A target list is prepared.
Vulnerabilities are tested.
Exploitation is automated.
Payloads are delivered.
Privileges are escalated.
Persistence is established.
Data is collected.
Results are transmitted.
The operation can then move to the next target.
Old Vulnerabilities Are Still New Opportunities
The campaign reportedly weaponized vulnerabilities that have been known for years.
That should concern every organization running legacy infrastructure.
An attacker does not care when a vulnerability was disclosed.
The attacker cares whether the vulnerable system is still reachable.
Public Exploits Change the Economics of Cybercrime
Once a vulnerability becomes publicly documented, the barrier to experimentation can fall dramatically.
Automation and AI-assisted tooling may further reduce the time required to adapt an exploit to a specific environment.
This means patch delays can become increasingly expensive.
AI Can Accelerate Troubleshooting
One of the least discussed advantages for attackers is troubleshooting.
Writing an exploit is difficult.
Understanding why an exploit failed can also be difficult.
AI can potentially assist operators in examining errors, adjusting scripts, and generating alternative approaches.
That can turn failed attempts into working attack paths more quickly.
Web Servers Remain High-Value Targets
A compromised web server can provide access to sensitive data, business applications, visitor traffic, authentication material, and trusted organizational infrastructure.
It can also be used for fraud, redirects, malware hosting, persistence, or further lateral movement.
The web server is often not the final objective.
It is the door.
Cloud Services Can Complicate Detection
Defenders cannot simply trust traffic because it uses HTTPS or communicates with a well-known cloud platform.
Legitimate infrastructure can potentially be abused.
Security monitoring must focus increasingly on abnormal behavior and context.
Endpoint Security Needs Multiple Layers
The reported use of vulnerable drivers demonstrates why antivirus or EDR software alone cannot be the complete defense.
If attackers can exploit weaknesses in the surrounding environment, they may attempt to reduce the visibility of the very tools designed to detect them.
Defense must include hardening, patching, privilege management, driver controls, logging, segmentation, and recovery planning.
Persistence Is Becoming More Flexible
Web shells are only one persistence method.
Scheduled tasks, RATs, custom backdoors, kernel modules, and cloud-based communication channels can all create different paths for attackers to remain operational.
Removing one malicious file may not remove the entire compromise.
Linux Is Not Automatically Safe
The campaign reportedly targeted both Windows and Linux.
The belief that Linux servers are inherently immune to serious compromise is dangerous.
Linux systems can contain vulnerable services, weak credentials, outdated packages, exposed administrative interfaces, and exploitable local privilege escalation flaws.
Scale Changes Everything
A list containing approximately 170,000 URLs represents more than a collection of targets.
It represents the possibility of repeated automated testing.
Even if only a tiny percentage of systems are vulnerable, large-scale scanning can still produce valuable compromises.
The
Attackers need one working path.
Defenders need to close many possible paths.
That imbalance means organizations must reduce exposure before attackers discover it.
Asset inventories and rapid remediation are becoming even more critical.
AI Will Probably Become More Integrated
The UAT-10147 activity suggests a direction rather than an endpoint.
Future campaigns may integrate AI more deeply into reconnaissance, exploit validation, scripting, log interpretation, and operational decision-making.
The distinction between “AI attack tools” and ordinary attack tools may gradually disappear.
AI may simply become another component of the offensive toolkit.
The Most Dangerous Environments Are the Forgotten Ones
Old web servers.
Abandoned applications.
Legacy frameworks.
Unpatched administrative panels.
Unused cloud instances.
These systems can become easy targets because they may not receive the same attention as critical modern infrastructure.
Detection Must Focus on Behavior
Security teams should look for unusual privilege escalation, suspicious scheduled tasks, unexpected web shells, unauthorized kernel modules, abnormal outbound HTTPS traffic, and unexplained changes to endpoint security configurations.
Behavior often reveals what a reputation database cannot.
Assume Initial Access Is Not the End
A detected exploit attempt should trigger an investigation into what may have happened afterward.
Did the attacker establish persistence?
Did privileges change?
Were credentials accessed?
Was data collected?
Did the server communicate with unusual external infrastructure?
The first compromise event may only be the beginning.
The Human Element Still Matters
Despite the growing role of AI, human expertise remains visible throughout sophisticated cyber operations.
The most dangerous future may not be autonomous malware replacing humans.
It may be skilled operators becoming significantly faster through AI assistance.
Deep Analysis
Asset Discovery Should Be the First Defensive Command
Organizations should continuously identify exposed and potentially forgotten systems.
sudo nmap -sV -Pn example.com
The purpose is to understand which services are visible and whether unexpected software is exposed.
Only scan systems you own or are explicitly authorized to test.
Patch Status Must Be Verified Continuously
On Debian-based systems, administrators can review available updates with:
sudo apt update && apt list --upgradable
On Red Hat-based systems, the equivalent process may include:
sudo dnf check-update
The objective is to identify known software weaknesses before attackers can exploit them.
Suspicious Scheduled Tasks Should Be Reviewed
Because the reported Windows activity used a deceptive scheduled task for persistence, administrators should inspect scheduled tasks and investigate unfamiliar entries.
On Windows:
Get-ScheduledTask | Select-Object TaskName,TaskPath,State
Unexpected task names that imitate trusted applications deserve additional investigation.
Linux Persistence Can Be Investigated Through Services and Cron
Administrators can review enabled services with:
systemctl list-unit-files --state=enabled
Cron-related persistence can also be inspected with:
crontab -l sudo ls -la /etc/cron
Unexpected services, scripts, or scheduled commands should be investigated before removal.
Unexpected Kernel Modules Require Attention
Because the reported Linux variant can deploy a kernel-level component, administrators can inspect currently loaded modules using:
lsmod
Additional system and kernel information can be reviewed with:
uname -a
Unknown modules should be analyzed carefully within an incident-response process.
Outbound Network Activity Should Be Baseline Compared
Administrators can inspect active network connections using:
ss -tulpn
Or:
sudo lsof -i -P -n
Unexpected outbound connections from web servers may indicate malware, data exfiltration, or unauthorized remote access.
Web Roots Should Be Monitored for Unexpected Files
For environments running web services, administrators can identify recently modified files with:
find /var/www -type f -mtime -7 -ls
Unexpected .ashx, .php, script files, or recently modified web content should be reviewed in the context of the application’s normal deployment process.
Privilege Escalation Evidence Should Be Preserved
Investigators should avoid immediately destroying evidence during a suspected compromise.
Useful commands for initial situational awareness include:
id who last ps auxf
These commands can help identify users, sessions, and active processes, although deeper forensic collection should follow established incident-response procedures.
Logs Remain Critical
Recent authentication and system events can be reviewed using:
sudo journalctl -xe
Web server logs should also be examined for unusual requests, exploitation attempts, unexpected POST activity, or suspicious requests targeting vulnerable application components.
Recovery Must Be Planned Before an Incident
If a system shows signs of deep persistence, especially at the kernel or security-control level, simply deleting a detected malware file may not provide sufficient assurance.
Organizations should maintain tested backups, incident-response procedures, credential rotation plans, and the ability to rebuild critical systems from trusted sources.
Research Findings
✅ The source states that UAT-10147 targeted Windows and Linux web servers and used known vulnerabilities, open-source offensive tools, and automation as part of its operations.
✅ The reported investigation identified approximately 170,000 URLs in the actor’s target list and described malware including BadIIS, Quasar RAT, Gh0stCringe, Noodle RAT, and the newly reported SPECTRE implant.
❌ The source does not establish that AI independently conducted the entire campaign without human operators. Instead, it describes AI-powered and AI-oriented tools being integrated into different stages of the attack workflow.
Prediction
(+1)
AI-assisted offensive tooling will likely become more deeply integrated into vulnerability discovery, exploit troubleshooting, scripting, reconnaissance, and post-exploitation automation.
Large target lists combined with automated validation may increase the speed at which unpatched internet-facing servers are identified and compromised.
Organizations that continue operating outdated, forgotten, or poorly monitored web infrastructure may face increasing exposure as attackers improve automation and reduce the cost of scanning at scale.
Defensive tools may face greater pressure to identify suspicious behavior rather than relying only on known malware signatures or blocked destinations.
Final Perspective: Cybercrime Is Becoming Faster, Not Necessarily Fully Autonomous
The UAT-10147 campaign offers an important warning about the direction of modern cybercrime.
The danger is not that machines have suddenly replaced attackers.
The danger is that attackers can increasingly combine human expertise with automation, AI assistance, reusable malware, public exploits, cloud infrastructure, and large-scale target discovery.
That combination can make cyber operations faster, more repeatable, and potentially more difficult to detect.
For defenders, the response cannot be fear of AI.
It must be preparation.
Patch exposed systems.
Identify forgotten assets.
Monitor unusual behavior.
Restrict unnecessary privileges.
Investigate persistence.
Protect logs.
Test recovery procedures.
And most importantly, assume that attackers are becoming more efficient at turning publicly available information into operational advantage.
The global attack surface is enormous.
UAT-10147 shows how quickly that surface can be transformed into a hunting ground when automation and AI-assisted tradecraft begin working together.
▶️ Related Video (82% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: thehackernews.com
Extra Source Hub (Possible Sources for article):
https://www.digitaltrends.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
