The AI-Augmented Underground: Inside UAT-10147’s Global Campaign Targeting Windows and Linux Servers

Executive Overview

Unlike traditional threat groups that rely strictly on manual scripting and human-driven reconnaissance, UAT-10147 uses AI to refine exploits, troubleshoot logic errors, automate complex post-exploitation workflows, and generate extensive operational documentation. The group’s primary objectives—ranging from search engine optimization (SEO) fraud and data exfiltration to establishing deep, resilient persistence—are supercharged by this AI-driven efficiency.

The campaign’s footprint is truly global, with primary victim telemetry concentrated in Brazil, Bolivia, China, Canada, and Vietnam. However, a broader analysis of infrastructure linked to the threat actors reveals a targeted universe stretching far beyond these regions, pointing to an operation designed for industrial-grade impact. Central to this campaign is the deployment of SPECTRE, a remarkably advanced, cross-platform implant complete with kernel-level rootkit capabilities, an innovative Bring Your Own Vulnerable Driver (BYOVD) mechanism, and Endpoint Detection and Response (EDR) blinding functionalities.

Detailed Chronology & Attack Mechanics

The operational methodology of UAT-10147 demonstrates a masterclass in automated, multi-platform compromise. Security researchers uncovered the group’s active infrastructure following the discovery of an open directory hosted at IP address 139.180.197[.]150, which was observed directly communicating with a compromised target machine.

Initial Access and Reconnaissance at Scale

UAT-10147 routinely leverages publicly disclosed vulnerabilities to achieve initial remote code execution (RCE) against web servers and Internet Information Services (IIS) environments. Rather than manually probing targets, the actors deploy open-source offensive frameworks like Metasploit, ysoserial, and specialized automation pipelines to scan networks and execute proof-of-concept exploits at scale.

Among the weaponized vulnerabilities are well-known flaws across enterprise software solutions, including:

• CVE-2022-27925 (Zimbra Collaboration Suite)
• CVE-2021-23758 (AjaxPro)
• CVE-2019-18935 (Telerik UI for ASP.NET AJAX)
• CVE-2021-29441 & CVE-2021-29442 (Alibaba Nacos)

Once initial access is established, the adversaries pivot to local privilege escalation (LPE) depending on the underlying operating system. On Linux systems, they cycle through a robust toolkit of historical and modern kernel exploits—such as CVE-2022-0995, CVE-2021-3156, CVE-2015-5287, CVE-2015-3246, CVE-2010-3904, and CVE-2022-0847—to rapidly attain root privileges.

AI Integration in Post-Exploitation Operations

What sets UAT-10147 apart is its systematic embedding of AI tools like PentestGPT and DeepAudit into its day-to-day command-and-control (C2) operations. Talos researchers identified instances where PentestGPT was actively used on C2 servers to scan targeted web servers, interpret command-line outputs, and execute precise exploitation chains.

Furthermore, the actors developed customized Python utilities and AI-assisted scripts to streamline operations:

1. Diagnostic Utility: A post-exploitation script designed to troubleshoot web shell write failures and environment errors in real time.
2. ViewState Deserialization Tooling: Scripts leveraging ASP.NET ViewState deserialization primitives to seamlessly download, drop, and execute the SPECTRE implant or deploy ASHX web shells onto compromised IIS servers.
3. Stealthy Exfiltration Utility: A specialized script that bundles webfoot enumeration data, IIS site inventories, and privilege assessments, encrypting them and transmitting them via HTTPS to a legitimate SaaS webhook endpoint.

By utilizing legitimate cloud-based configuration management services (such as Alibaba Nacos instances) for data exfiltration, UAT-10147 masks its traffic inside routine administrative traffic. This asynchronous exfiltration sink allows the operators to verify successful compromises without ever needing to establish a noisy reverse shell or maintain persistent inbound connections, drastically lowering their detection footprint.

The SPECTRE Implant: Cross-Platform Threat Evolution

The pinnacle of UAT-10147’s tradecraft is the SPECTRE implant, a sophisticated, cross-platform backdoor written in C that made its debut in early 2026. Designed with heavy anti-analysis and obfuscation properties, SPECTRE relies on a rigorous environmental scoring mechanism before executing its payload. If a host scores above 50 points based on CPU core counts, available RAM, disk space, blocklisted process names, or the presence of common sandbox usernames and hostnames, the implant instantly self-terminates.

Windows Variant & The BYOVD EDR Blind-Spot

On Windows environments, SPECTRE acts as a Swiss Army knife. It supports up to 45 distinct commands, granting operators full control over file manipulation, keylogging, screenshot capture, process injection (utilizing process hollowing and Early Bird APC injection), and credential theft.

Most alarming is SPECTRE’s weaponization of the Bring Your Own Vulnerable Driver (BYOVD) technique. The malware drops and installs two notorious signed, vulnerable drivers:

• MSI’s RTCore64.sys (CVE-2019-16098)
• Dell’s DBUtil_2_3.sys (CVE-2021-21551)

Through targeted kernel writes enabled by these drivers, SPECTRE safely unlinks registered EDR callbacks from their doubly-linked lists in kernel memory. Security products such as CrowdStrike Falcon, SentinelOne, and Microsoft Defender are rendered completely blind to subsequent process creations, thread creations, and image load events for the remainder of the active session.

Linux Variant & The Specter Kernel Rootkit

The Linux version of SPECTRE is equally formidable, supporting 29 commands focused on file system control, process reconnaissance, and shell execution. Its crowning capability is an integrated kernel-level rootkit—also named Specter—deployed directly as a loadable kernel module.

Forensic analysis of the rootkit’s source code strongly suggests AI generation. Researchers noted the presence of highly descriptive comments, uniform decorative separators explaining individual functions, and multiple redundant methods written to achieve the exact same operational outcome—a classic fingerprint of LLM-prompted code generation prioritizing thoroughness over minimalist efficiency. Once loaded, this rootkit grants persistent kernel-level control that easily survives system reboots and circumvents standard user-space security controls.

Supporting Context & Metrics

The sheer scale of UAT-10147’s infrastructure underscores the industrial nature of modern cybercrime.

• 170,000 Targeted URLs: Analysis of a recovered text file within the actors’ open directory revealed a massive target list containing approximately 170,000 distinct URLs. To parse this data efficiently, the operators split the master list into 17 smaller chunks of roughly 10,000 URLs each.
• Geographic Distribution of Targets: While the initial victim telemetry highlights a heavy concentration in developing digital markets—specifically Brazil, Bolivia, China, Canada, and Vietnam—the broader target URL lists heavily skew toward enterprise hubs in the United States, India, the United Kingdom, Germany, and the Netherlands.
• Sector Agnosticism: The campaign does not discriminate by industry, impacting high-value verticals where operational uptime is critical, including higher education, digital media, corporate technology infrastructure, and the global gaming industry.
• Commodity Malware Integration: UAT-10147 heavily integrates existing ecosystem components, such as the widely documented BadIIS malware framework, which operates under a Malware-as-a-Service (MaaS) model shared across multiple Chinese-speaking threat syndicates.

Official Statements & Industry Analysis

Security researchers have underscored that UAT-10147 represents a fundamental shift in how lower-tier and mid-tier cybercrime groups operationalize advanced capabilities.

"By routing exfiltrated data to a legitimate cloud-based configuration management service, the attackers effectively blend their traffic with normal administrative operations," noted Joey Chen, senior threat researcher at Cisco Talos. "This infrastructure choice acts as an asynchronous exfiltration sink, allowing the adversaries to poll their own Nacos instance to verify successful exploitation across victims without the operational overhead or detection risk of establishing a persistent reverse shell or maintaining direct inbound connections."

Regarding the deployment of the SPECTRE framework, Cisco Talos emphasized the severity of the threat in their official advisory:

"The newly identified SPECTRE implant represents a significant evolution in commodity intrusion tooling, integrating cross-platform command-and-control (C2) operations, process injection, credential theft, anti-analysis protections, and kernel-level endpoint detection and response (EDR) bypass functionality."

Furthermore, researchers point out that tools like DeepAudit—found sitting idle on the threat actors’ management servers—may serve a dual purpose. While intended primarily for automated vulnerability scanning, such frameworks could theoretically be used by threat actors to audit their own attack infrastructure, ensuring their toolsets remain undetected by competing threat groups or automated security scanners.

Future Outlook & Defense Recommendations

The emergence of UAT-10147 serves as an urgent wake-up call for security architects worldwide. As cybercrime syndicates increasingly adopt agentic AI to automate reconnaissance, code optimization, and payload validation, the velocity of attacks will far outpace manual human defense models. The ability of threat actors to blend exfiltration into legitimate SaaS traffic and blind commercial EDR tools via kernel-level BYOVD attacks highlights the obsolescence of perimeter-only security models.

To defend against AI-augmented campaigns like UAT-10147, organizations must adopt a proactive, multi-layered defensive posture:

1. Harden Kernel Boundaries & Monitor Driver Loads: Implement strict application control and driver blocklists (such as Microsoft’s recommended vulnerable driver blocklist) to prevent the execution and abuse of signed, vulnerable components like RTCore64.sys and DBUtil_2_3.sys.
2. Behavioral EDR and Out-of-Band Monitoring: Because EDR user-space and kernel-space callbacks can be targeted by advanced rootkits, security teams must deploy out-of-band network monitoring, flow analytics, and hypervisor-level inspection to detect anomalous cloud configuration traffic (e.g., unauthorized polling of Nacos or webhook endpoints).
3. Rigorous Patch Management: Given UAT-10147’s reliance on publicly disclosed vulnerabilities (such as Zimbra, Telerik, and Alibaba Nacos flaws), organizations must prioritize rapid patch deployment across both Windows IIS and Linux web server environments.
4. Identity and Access Governance: Enforce Zero Trust principles, ensuring that web-facing applications run with the absolute minimum privilege required, thereby mitigating the impact should a web shell or remote code execution vulnerability be successfully exploited.

As threat actors continue to leverage artificial intelligence as a force multiplier, security defenders must similarly embrace AI-driven threat hunting, behavioral anomaly detection, and automated remediation to stay one step ahead of the evolving underground economy.