Chinese Cybercrime Group UAT-10147 Launches AI-Powered Server Attacks
Deploying EDR bypass and Linux rootkit to target global servers.
1Group Targeting Global Servers
Chinese cybercrime group UAT-10147 is targeting Windows and Linux servers in education, media, technology, and gaming sectors. According to Cisco Talos, attacks were detected in Brazil, Bolivia, China, Canada, and Vietnam. The group uses a target list containing 170,000 URLs, split into 17 smaller files for efficiency. The most targeted countries are the U.S., India, the U.K., Germany, and the Netherlands.
2AI-Powered Attack Strategy
UAT-10147 uses AI-powered tools to refine exploits, troubleshoot logic, and automate post-exploit workflows. Their DeepAudit framework scans for vulnerabilities in target systems. Open-source tools like PentestGPT are used to scan servers and execute relevant PoC exploits. These tools facilitate operational documentation, enabling large-scale offensive operations.
3EDR Evasion and Root Access
Attackers exploit known vulnerabilities to achieve remote code execution (RCE) and deploy malware via automated scripts. On Linux systems, LPE exploits like CVE-2022-0995 and CVE-2021-3156 are used to gain root access. After root access, backdoors like Noodle RAT, SPECTRE, and Meterpreter are deployed to establish persistent C2 connections.
4SPECTRE Backdoor Features
SPECTRE is a cross-platform backdoor written in C, communicating via HTTPS with C2 servers. It supports 45 commands for extensive endpoint control and employs obfuscation and anti-analysis techniques. First observed in April 2026, this implant operates under a malware-as-a-service (MaaS) model, as noted by Talos.
5Cloud-Based Data Exfiltration
Attackers blend exfiltrated data with legitimate cloud configuration management traffic to avoid detection. This method allows verification of successful exploitation without persistent reverse shells. Vulnerabilities like CVE-2021-29441 and CVE-2021-29442 in Alibaba Nacos are weaponized for this purpose.
6AI-Generated Python Scripts
UAT-10147 uses four Python scripts. The first troubleshoots web shell write failures post-exploit. The second leverages ViewState deserialization to download and execute SPECTRE. The third deploys ASHX web shells via the same mechanism. The fourth blends exfiltration with SaaS traffic over HTTPS to transmit host details.
7SEO Fraud and Data Theft
The group monetizes through SEO fraud and data theft. BadIIS malware operates under a MaaS model, shared among multiple Chinese crime groups. Attackers exploit vulnerabilities in Zimbra, AjaxPro, and Telerik UI to establish persistent access via web shells.
8Critical Warning for Industries
Education, media, and tech sectors must urgently patch servers. Cisco Talos recommends closing known vulnerabilities and adopting proactive defenses against AI-powered tools. Sophisticated backdoors like SPECTRE enable long-term data leaks, necessitating enhanced network monitoring and anomaly detection.