Fools guide to UAT-10147

A Chinese-speaking cybercrime group known as UAT-10147 is currently targeting Windows and Linux web servers across the globe, this is in order to facilitate SEO fraud and data theft. The group makes heavy use of AI-powered tools alongside open-source frameworks in order to execute their attack cycles, Metasploit (a toolkit that enables hackers to find, exploit and validate security flaws), pentestGPT (an offensive security focused AI agent that can help users walkthrough penetration tests and analyse findings) and DeepAudit (An AI based tool that supports analyse of code, cloud server configs and attack surfaces for vulnerabilities) are examples of these such tools currently being utilised by UAT-10147.

Impact:

Due to the heavy automation and usage of pre-existing exploits the group is able to target organisations globally and in a variety of sectors such as education, media, technology and the gaming industry. These attacks are concentrated within Brazil, Bolivia, China, Canada and Vietnam. The victims of these attacks are facing data theft, SEO manipulation (Tampering with how search engines rank websites to affect the flow of web traffic), alongside this victims are dealing with persistent compromise with backdoors such as SPECTRE (A piece of malware that's able to run commands, steal data and evade detections on both linux and windows systems)) being used which are able to bypass kernel-level EDRs (A security system built into the core of an operating system that watches all operations on a computer).

Exploitation:

The group primarily operates in a script kiddie manner, meaning they gain access by exploiting publicly disclosed vulnerabilities (instead of developing their own exploits), in order to gain remote code execution on web servers and IIS (internet information services), or local privilege escalation on linux. Thor attacks are being automated via using the AI tools and frameworks mentioned above, this automation is used to deploy web shells and sophisticated malware such as the previously mentioned SPECTRE and BadIIS (BadIIS is a server‑side SEO‑poisoning malware designed to infect Microsoft IIS servers and hijack web traffic), In order to gain persistence on systems alongside data exfiltration, They seem to often blend traffic with legitimate cloud services alongside the use of vulnerable drivers to disable EDRs.

Mitigation:

These attacks serve as a reminder that out of date software can be a massive risk to security, and that sysadmins should make sure and ensure that known vulnerabilities are patched on systems their manage.