UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
Summary: Cisco Talos reported in early 2026 that a Chinese-speaking cybercrime group it tracks as UAT-10147 targets vulnerable web servers for SEO fraud and data theft, with affected servers found in Brazil, Bolivia, China, Canada, and Vietnam across government, university, media, technology, and gaming sectors. Talos assessed with moderate-to-high confidence that the group is among financially motivated operators using agentic AI to scale offensive tradecraft, and found a target list of roughly 170,000 URLs on its command-and-control server split into 17 files of about 10,000 each.
Key Takeaway: The group exploited known one-day flaws such as CVE-2022-27925 in Zimbra and CVE-2019-18935 in Telerik, and its ViewState attack depends entirely on exposed ASP.NET MachineKey material, making key confidentiality the control that decides whether it works. A target list of about 170,000 URLs, split into 17 files so scanning could run in parallel, is the scale a single actor now works at.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026