UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

Overview

Cisco Talos researchers have published detailed analysis of UAT-10147, a Chinese-speaking cybercrime group that has industrialized web server compromise using agentic AI and a custom cross-platform implant called SPECTRE. The disclosure reveals a target list of approximately 170,000 URLs spread across 17 files on attacker-controlled infrastructure — all internet-facing IIS and Linux web servers across education, media, technology, and gaming sectors in Brazil, Bolivia, Canada, China, and Vietnam.

What sets UAT-10147 apart is not the scale alone, but the integration of AI into the post-compromise workflow itself, and a Linux rootkit whose source code contains AI-generated comments — the first documented case of AI-assisted kernel-mode offensive development at this scale.

Who Is UAT-10147

UAT-10147 is a financially motivated intrusion actor with Chinese-speaking attribution. Development artifacts inside the tooling reference the pseudonym "xshen" / "x神" and use the Chinese character "萬" (wan) as numeric shorthand in target lists. The group is not linked to an established APT cluster but straddles cybercrime and espionage tradecraft. Primary monetization is SEO fraud and data theft.

Initial Access: Exploiting Unpatched Web Servers at Scale

UAT-10147 does not rely on novel zero-days. They scan for and exploit publicly disclosed vulnerabilities in IIS and ASP.NET applications at scale, using an AI-augmented toolkit that includes:

• Metasploit and ysoserial (Java deserialization exploitation)
• PentestGPT and DeepAudit — agentic AI tools used to generate operational playbooks, automate exploit selection and validation, and troubleshoot exploit paths in real time

The AI integration is not limited to recon. Talos confirmed it is woven into the live post-compromise workflow, enabling the group to operate at a scale that would otherwise require a large, specialized team.

SPECTRE: A Cross-Platform Implant

SPECTRE is a custom backdoor that runs on both Windows and Linux. Its capabilities differ by platform but share a common HTTP-based C2 architecture.

Windows Capabilities

On Windows, SPECTRE is a sophisticated post-exploitation platform:

• Credential theft: SAM/SYSTEM/SECURITY registry hive collection, Windows Credential Manager enumeration, Chrome and Edge credential harvesting
• Process injection and token theft
• Persistence: Scheduled tasks disguised as "Google Chrome Start," local administrator account creation, Microsoft Defender exclusions

BYOVD EDR Bypass: Kernel Callback Unlinking

The most technically significant capability in SPECTRE is its Bring Your Own Vulnerable Driver (BYOVD) EDR bypass. The implant downloads two well-known vulnerable drivers to the target system:

• RTCore64.sys — the MSI Afterburner driver
• DBUtil_2_3.sys — the Dell BIOS Update driver

Using these drivers' kernel write primitives, SPECTRE performs kernel callback unlinking: it directly modifies the kernel's callback table entries for process creation, thread creation, and image-load events. These callbacks are the primary telemetry hooks used by Microsoft Defender and third-party EDR products. Unlinking them blinds the EDR sensor for the remainder of the session — no process creation events, no image-load events, no thread creation events reach the sensor.

This is a well-understood BYOVD technique, but its integration into a campaign targeting 170,000 servers demonstrates how commodity BYOVD tooling has been industrialized at scale.

Mitigations for BYOVD:

• Enable HVCI (Hypervisor-Protected Code Integrity) — prevents unsigned or vulnerable drivers from loading at the kernel level
• Maintain and enforce Microsoft's recommended driver block list (updated regularly via Windows Update)
• Monitor for the specific hashes and names of RTCore64.sys and DBUtil_2_3.sys at the network perimeter

The Linux Rootkit: Specter

On Linux targets, SPECTRE deploys a kernel-mode rootkit named Specter — deliberately disguised as the legitimate ACPI power management module acpi_pad.ko. It is persisted via a fraudulent systemd service.

Specter hides processes and kernel modules from userspace inspection and elevates privileges. Notably, Talos found AI-generated code comments still embedded in the rootkit source — inline documentation that matches the style of LLM-generated code, indicating the rootkit was written with AI assistance and the comments were never removed before deployment.

This is the first publicly documented case of AI-assisted development in kernel-mode offensive tooling at this scale. The implication for defenders is significant: AI is now reducing the expertise barrier for writing kernel-level malware.

Full Toolkit

Beyond SPECTRE, UAT-10147's toolkit includes:

• Noodle RAT — a Linux remote access trojan
• QuasarRAT and Gh0stCringe — Windows RATs
• Meterpreter — for flexible post-exploitation
• Custom in-memory web shells — for initial foothold persistence

Detection and Defense

Network and Host Indicators

• Snort/ClamAV SIDs: 1:66697, 1:66696
• Monitor certutil.exe and powershell.exe for Base64-encoded downloads and external HTTP requests
• Flag process spawning chains from IIS (w3wp.exe) or Java processes that invoke cmd.exe, powershell.exe, or sh
• Alert on new local administrator account creation outside of provisioning workflows
• Monitor for kernel module loads matching acpi_pad.ko on systems where the genuine ACPI pad module is not expected

Hardening Priorities

1. Patch IIS and ASP.NET — UAT-10147 exploits known, patched vulnerabilities; unpatched internet-facing web servers are the primary attack surface
2. Enable HVCI on Windows servers where feasible — this alone defeats the BYOVD EDR bypass
3. Disable SeImpersonatePrivilege on IIS service accounts where token impersonation is not required
4. Review and enforce egress filtering — post-compromise C2 traffic and data exfiltration require outbound connectivity
5. Deploy Linux runtime security (e.g., Falco, auditd) to detect unexpected kernel module loads and process privilege escalation

The AI-in-the-Loop Inflection Point

The UAT-10147 campaign illustrates a structural shift that security teams will need to account for. AI is not being used merely for recon or phishing generation — it is embedded in the post-compromise operational loop, generating playbooks, validating exploits, and assisting with malware development in real time. The result is that a campaign targeting 170,000 servers with kernel-level implants, BYOVD EDR bypass, and AI-assisted rootkit development does not require a nation-state budget or a large specialized team.

For defenders, the asymmetry is uncomfortable: agentic AI amplifies attacker throughput without a corresponding amplification in the expertise required, while defenders still need to triage, investigate, and respond at human speed.

Sources

• Cisco Talos — UAT-10147 deploys SPECTRE: cross-platform implant with Linux rootkit and BYOVD
• Cisco Talos — UAT-10147: Chinese-speaking adversary integrates agentic AI
• The Hacker News — UAT-10147 Uses AI to Scale Server Attacks
• Cyber Insider — Chinese hackers use AI to automate attacks on 170,000 servers