Post cover image
UAT-10147 Attack Flow

August 25, 2026

UAT-10147: How AI-Assisted Attackers Are Scaling Server Compromises

UAT-10147: How AI-Assisted Attackers Are Scaling Server Compromises

By GO_TryHarder

5 min read

AI is no longer just helping attackers write better code. It is starting to help them scale the entire intrusion workflow.

A Chinese-speaking cybercrime group tracked as UAT-10147 has reportedly combined AI-assisted tooling with a cross-platform backdoor to target internet-facing Windows and Linux web servers at scale.

According to reporting from Cisco Talos, researchers found a target list containing roughly 170,000 web server URLs across countries including the United States, India, the United Kingdom, and Germany. The group allegedly exploited known public-facing vulnerabilities to gain remote code execution, deploy malware, manipulate SEO, and support data theft operations.

But the most important takeaway is not simply that attackers are "using AI."

The bigger issue is that AI appears to be helping them scale the entire intrusion workflow:

  • Reconnaissance
  • Exploit refinement
  • Debugging
  • Validation
  • Post-compromise automation
  • Operational playbook generation

That makes this campaign worth watching closely.

Why this case matters

UAT-10147 represents a broader shift in offensive operations.

In the past, complex post-exploitation activity often required experienced operators with deep technical skills. AI-assisted tooling can lower that barrier by helping attackers troubleshoot errors, refine scripts, and repeat successful techniques across large target sets.

Cisco Talos reported that the group used tools such as PentestGPT and DeepAudit in post-compromise workflows. This suggests that attackers are no longer using AI only for basic phishing text or simple code generation.

They are beginning to integrate AI into real intrusion operations.

For defenders, this means vulnerable internet-facing assets may be attacked faster, more repeatedly, and with less manual effort from adversaries.

Target profile: exposed web servers

The campaign focused on vulnerable web servers and server-side applications. Public reporting linked the activity to exploitation of known vulnerabilities affecting technologies such as:

Vulnerability Affected technology CVE-2022–27925 Zimbra CVE-2021–23758 AjaxPro CVE-2019–18935 Telerik UI for ASP.NET AJAX CVE-2021–29441 / CVE-2021–29442 Alibaba Nacos

These vulnerabilities share a common defensive lesson:

Internet exposure changes risk priority.

A known remote-code-execution issue on an externally reachable system should be treated as urgent, especially when exploit code or active exploitation is publicly known.

SPECTRE: more than a typical backdoor

A major component of the campaign is SPECTRE, a cross-platform implant targeting both Windows and Linux environments.

On Windows, SPECTRE reportedly uses BYOVD, or Bring Your Own Vulnerable Driver, techniques. In this approach, attackers bring a legitimate but vulnerable signed driver and abuse it to gain kernel-level capabilities. This can allow them to tamper with security controls and interfere with endpoint detection mechanisms.

On Linux, reports describe kernel-level rootkit functionality that can help attackers maintain persistence and conceal activity even after reboot.

That matters because removing an obvious web shell or suspicious userland process may not fully eradicate the intrusion.

In other words, SPECTRE is not just another backdoor. It reflects an attempt to combine persistence, evasion, credential access, process manipulation, and endpoint defense disruption across multiple operating systems.

Attack flow

None

At a high level, the campaign can be understood as follows:

  1. Identify exposed web servers.
  2. Exploit known public vulnerabilities.
  3. Gain remote code execution.
  4. Deploy web shells and follow-on payloads.
  5. Install the SPECTRE backdoor.
  6. Branch into Windows or Linux-specific persistence and evasion.
  7. Abuse BYOVD on Windows or load kernel-level rootkits on Linux.
  8. Disable or bypass endpoint security controls.
  9. Support SEO fraud, data theft, persistence, and further operations.
  10. Use AI tools to accelerate debugging, validation, and repeatable automation.

Defensive implications

1. Asset visibility is now a first-line control

Organizations cannot protect systems they do not know exist.

A campaign involving a 170,000-URL target list shows why exposed asset discovery is essential. Security teams should maintain an up-to-date inventory of:

  • Internet-facing web servers
  • Admin panels
  • Legacy applications
  • Test and staging environments
  • Forgotten subdomains
  • Third-party-hosted assets

Attackers often do not need to breach the most important system first. They only need one forgotten, vulnerable entry point.

2. Patch priority should reflect exploitability

Traditional patch queues often rely too heavily on CVSS scores.

For internet-facing systems, defenders should prioritize based on:

  • Remote code execution potential
  • Public exploit availability
  • Active exploitation evidence
  • Whether the system is externally reachable
  • Whether the product appears in CISA KEV or similar exploited-vulnerability catalogs
  • Whether the asset handles credentials, sensitive data, or privileged access

This case reinforces the need to move from "highest score first" to risk-based vulnerability management.

3. BYOVD detection and prevention are critical

BYOVD remains a serious challenge because attackers abuse signed drivers that may appear legitimate at first glance.

Recommended actions include:

  • Enforce vulnerable driver blocklists.
  • Enable Microsoft's vulnerable driver protections where applicable.
  • Monitor suspicious driver load events.
  • Investigate attempts to disable security callbacks or tamper with EDR components.
  • Restrict local administrator rights.
  • Use application control or driver allowlisting for high-risk systems.

Endpoint protection should not be treated as a single point of failure. If an attacker can operate at kernel level, detection must also include telemetry from network, identity, cloud, and server logs.

4. Linux rootkit response requires more than file cleanup

If a Linux server is suspected of kernel-level compromise, defenders should avoid assuming that deleting a web shell or suspicious binary is sufficient.

Response steps should include:

  • Preserve forensic evidence before remediation.
  • Inspect loaded kernel modules and persistence mechanisms.
  • Review unexpected changes under /etc, /usr/lib, /lib/modules, and startup paths.
  • Check for hidden processes, hidden ports, and abnormal syscall behavior.
  • Compare system binaries against trusted baselines.
  • Rebuild from a known-good image when kernel compromise is likely.

For production environments, a clean rebuild is often safer than attempting partial cleanup.

5. IOC-based hunting should be combined with behavior-based detection

Cisco Talos published indicators of compromise related to this activity. These indicators can help teams search across SIEM, EDR, NDR, firewall, DNS, and proxy logs.

However, IOC matching alone is not enough.

Attackers can rotate infrastructure, modify payloads, or generate new artifacts. Detection should also focus on behaviors such as:

  • Web server spawning unusual child processes
  • Unexpected outbound connections from web application hosts
  • New scheduled tasks or services after web exploitation
  • Suspicious driver loading
  • Security tool tampering
  • Kernel module anomalies
  • Web shells executing encoded commands
  • Abnormal SEO-related file modifications or redirects

Key lessons for defenders

The UAT-10147 activity highlights five practical lessons.

1. AI is becoming an operational accelerator for attackers.

It can help attackers debug, automate, and repeat intrusion steps at scale.

2. Known vulnerabilities remain highly effective.

Attackers do not need zero-days when exposed systems remain unpatched.

3. Cross-platform implants increase response complexity.

Windows and Linux teams need coordinated detection and remediation playbooks.

4. Endpoint security must be reinforced with layered telemetry.

BYOVD and rootkit techniques can weaken endpoint-only assumptions.

5. External attack surface management is essential.

Forgotten public-facing assets are ideal targets for automated exploitation.

Conclusion

UAT-10147 is a reminder that AI-assisted cyber operations are not theoretical.

Attackers are beginning to use AI as a practical force multiplier across reconnaissance, exploitation, debugging, and post-compromise workflows.

The defensive response should be equally practical. Organizations should improve external asset visibility, prioritize actively exploited internet-facing vulnerabilities, harden against BYOVD techniques, monitor Linux systems for rootkit behavior, and combine IOC-based hunting with behavior-based detection.

The core lesson is simple:

In an era of AI-assisted attack automation, defenders must reduce exposed attack surface faster and detect deeper than before.

References