UAT-10147 runs public exploits through an AI pipeline, and old CVEs are still the door
Cisco Talos says a Chinese-speaking crew paired PentestGPT and DeepAudit with Metasploit and a 170,000-URL target list to compromise web servers at scale. Every entry flaw named is years old.
The Watch · Security desk
What happened
- Cisco Talos, in a two-part report, details a Chinese-speaking crew it calls UAT-10147 hitting Windows and Linux web servers in education, media, technology and gaming.
- Its toolkit mixes Metasploit and ysoserial with PentestGPT and DeepAudit plus privilege escalation exploits, used to automate intrusion and persistence.
- An open directory exposed a target list of roughly 170,000 URLs, split into 17 files of about 10,000 for faster parsing.
- On Windows, EfsPotato elevates, Quasar RAT persists via a scheduled task named "Google Chrome Start", and BadIIS and Gh0stCringe follow.
- On Linux, known local privilege escalation bugs get root, then Noodle RAT, SPECTRE and Meterpreter call out to command-and-control.
Why it matters
- What it limits constraint Every entry flaw named is public and years old, so the defensive variable is how long an exposed server stays unpatched, not how clever the implant is.
- Who's exposed exposure Organisations that treated a public IIS or web box as low-value now own a host where Defender exclusions were set and payloads deleted before the implants arrived.
- What doesn't add up contradiction The victim concentration and the target list share no countries, so which set you read decides whether you think you are in scope at all.
- What it sets up precedent Because the BadIIS variant is rented under a service model across multiple crews, indicator overlap will keep producing shared detections that cannot separate one actor from another.
Next story · Security · 2d ago
Open staging directories and GitHub history expose UAT-6275's four-chain campaign against CIS governmentsConfirmed4 publishers
The interesting part of the Talos account is not the implant, it is the throughput. The AI tooling is doing clerical labour: refining exploits, troubleshooting logic, validating that an exploit actually landed, automating post-exploitation, and generating operational documentation [2]. None of that is a new capability. All of it is the part of mass exploitation that historically needed a human, which is why campaigns against internet-facing servers usually run out of operator attention long before they run out of vulnerable hosts.
The infrastructure choice fits that reading. Talos researcher Joey Chen says exfiltrated data was routed to a legitimate cloud-based configuration management service so the traffic blends with normal administrative operations [21], and describes the setup as an asynchronous exfiltration sink the operators poll to confirm exploitation across victims without maintaining reverse shells or inbound connections [22]. Pair that with a 170,000-URL list chopped into 17 files of roughly 10,000 [5], which is arithmetically exact [23], and the shape is a job queue with workers, not a person with a terminal.
Then there is the geography, which does not line up. The heaviest observed victim concentration is Brazil, Bolivia, China, Canada and Vietnam [10]. The top five destinations on the actor's own target list are the United States, India, the United Kingdom, Germany and the Netherlands [13]. Zero countries appear in both sets [24]. Anyone in the second group reading the first group as a threat profile is reading the wrong column.
On the entry side, nothing here needed research. The named weaponised flaws are in Zimbra, AjaxPro, Telerik UI for ASP.NET AJAX and Alibaba Nacos [20], with assignment years between 2019 and 2022 [26]. The Linux privilege escalation set reaches back further, from CVE-2022-0995 to CVE-2010-3904, a twelve-year span with nothing newer than 2022 [19][25]. Talos's own summary is blunt about it: publicly disclosed vulnerabilities, used to gain initial access at scale [4]. Patch latency on exposed servers is the variable the attacker is exploiting, and it is now being consumed by an automated pipeline rather than a queue of humans.
Two cautions on the detection side. On Windows, EfsPotato is used to elevate and then configure Microsoft Defender exclusions [15], and the initial payloads are deleted afterwards [16], so quiet endpoint telemetry from one of these hosts is not evidence of anything. And the BadIIS component is the same variant sold under a malware-as-a-service model and used by multiple Chinese-speaking crews [18], which means a BadIIS hit tells you which shop supplied the module, not which crew is in your server.
Finally, the thin part. The report's own framing puts an EDR bypass in SPECTRE and a Linux rootkit in the chain [9], but what is actually described in the available summary is the Defender exclusion route [15] and a spread of post-root implants including Noodle RAT, SPECTRE and Meterpreter calling out to C2 [8]. The bypass mechanism and the rootkit sit in parts of the two-part report not reproduced here [3].
What to watch
- Whether the second part of the Talos report publishes SPECTRE samples, the EDR bypass mechanism and rootkit detection surface, which is what would let defenders test rather than assume.
- Whether compromises start appearing in the U.S., India, U.K., Germany and the Netherlands, which would flip the victim geography from the observed set to the target list.
- Whether the BadIIS malware-as-a-service supplier is named separately, which would force attribution to split between the tooling vendor and the crews renting it.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption20
- Hype gap+30
- Incentives65
- Confidence62
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
UAT-10147 conducts SEO fraud and data theft while integrating AI-powered tools at various phases of the attack cycle, including exploitation, reconnaissance, payload generation, validation and persistence.
- [2]
The AI use described involves refining exploits, troubleshooting logic, automating post-exploitation workflows, validating exploits and generating operational documentation.
- [3]
Cisco Talos published a two-part report describing a Chinese-speaking cybercrime group dubbed UAT-10147 that targets Windows and Linux web servers globally across the education, media, technology and gaming sectors.
- [4]
Talos said: "The actor leveraged publicly disclosed vulnerabilities to gain initial access at scale."
- [5]
The exposed directory held a text file with a target list of approximately 170,000 URLs, split by the attacker into 17 smaller files of about 10,000 URLs each for more efficient parsing.
- [6]
Attack chains involve exploiting known flaws for remote code execution on a website or a vulnerable IIS server, then running an automated script to install malware for SEO fraud or data stealing; some cases deploy a web shell that leads to BadIIS and additional backdoors.
- [7]
Follow-on implants include Gh0stCringe and a previously unreported cross-platform implant dubbed SPECTRE.
- [8]
After root access, the actor deployed backdoors including Noodle RAT (a variant of Gh0st RAT and Rekoobe), SPECTRE and Meterpreter to enable outbound connections to remote command-and-control infrastructure.
- [9]
The published report is framed as UAT-10147 deploying SPECTRE with an EDR bypass and a Linux rootkit.
- [10]
The vast majority of the observed targets are located in Brazil, Bolivia, China, Canada and Vietnam.
- [11]
The activity came to light after discovery of an open directory hosted at 139.180.197[.]150, which was seen communicating with one of the compromised machines.
- [12]
The actor used a mixture of open-source offensive frameworks including Metasploit, ysoserial, PentestGPT, DeepAudit and multiple privilege escalation exploits to automate intrusion operations and establish persistence.
- [13]
The top five destinations on the target list are the U.S., India, the U.K., Germany and the Netherlands.
- [14]
A batch script uses certutil to download the EfsPotato privilege escalation tool, a secondary batch script and Quasar RAT from adminapi.tippusoni[.]in.
- [15]
EfsPotato is used to gain elevated system privileges and configure Microsoft Defender exclusions.
- [16]
The actor deletes initial payloads to cover its tracks and thwart forensic analysis.
- [17]
Quasar RAT is executed silently and persists via a deceptive scheduled task named "Google Chrome Start".
- [18]
The core BadIIS malware is the same specific variant known to operate under a malware-as-a-service model and used by multiple Chinese-speaking cybercrime groups.
- [19]
Linux local privilege escalation exploits abused to reach root include CVE-2022-0995, CVE-2021-3156, CVE-2015-5287, CVE-2015-3246, CVE-2010-3904 and CVE-2022-0847.
- [20]
Vulnerabilities weaponised during the campaign include CVE-2022-27925 (Zimbra), CVE-2021-23758 (AjaxPro), CVE-2019-18935 (Telerik UI for ASP.NET AJAX), and CVE-2021-29441 and CVE-2021-29442 (Alibaba Nacos).
- [21]
Talos researcher Joey Chen said that by routing exfiltrated data to a legitimate cloud-based configuration management service, the attackers blend their traffic with normal administrative operations.
- [22]
Chen said the infrastructure choice acts as an asynchronous exfiltration sink, letting the adversaries poll their own Nacos instance to verify successful exploitation across victims without the overhead or detection risk of a persistent reverse shell or direct inbound connections.
- [23]
The chunking is arithmetically exact: 17 files of about 10,000 URLs accounts for the full 170,000-entry list.
- [24]
None of the five top countries on the actor's target list appear among the five countries where observed victims are concentrated: zero of five overlap.
- [25]
The six named Linux privilege escalation CVEs carry assignment years from 2010 to 2022, a twelve-year span, with none newer than 2022.
- [26]
The named initial-access CVEs carry assignment years between 2019 and 2022.
Sources
2 independent publishers whose own reporting we read for this story.
- reversinglabs.comAgentic AI scales semiautonomous server attacks
1 article · August 25, 2026
- thehackernews.comUAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
2 articles · August 24, 2026
Topics and entities
Topics
- Web server compromise
- AI-Enabled Cyberattacks