UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

Summary: Cisco Talos detailed a Chinese-speaking cybercrime group it calls UAT-10147 that targets Windows and Linux web servers in education, media, technology, and gaming, using publicly disclosed vulnerabilities for initial access and AI tools including PentestGPT and DeepAudit across exploitation, reconnaissance, and payload generation. An exposed directory at 139.180.197[.]150 held a target list of roughly 170,000 URLs split into 17 files of about 10,000 each, and the group deployed the SPECTRE backdoor, whose Linux variant loads a kernel-level rootkit named Specter and whose Windows version kills EDR processes via BYOVD using MSI's RTCore64.sys (CVE-2019-16098) and Dell's DBUtil_2_3.sys (CVE-2021-21551).
Key Takeaway: A target list of about 170,000 URLs, split into 17 files for faster parsing, shows the group's reach is bounded by automation rather than by hands - and SPECTRE's kernel-level rootkit survives reboots and most user-level security controls, so an infection that looks contained may not be.

Read the original at The Hacker News ↗

Topics: Threat Actors & Nation-State
Mentions: CVE-2010-3904 CVE-2015-3246 CVE-2015-5287 CVE-2019-18935 CVE-2021-23758 CVE-2021-29441 CVE-2021-29442 CVE-2021-3156 CVE-2022-0847 CVE-2022-0995 CVE-2022-27925
Related: CISA Adds Six Exploited Flaws to KEV, Including Net Scaler, Linux, and SQL Server Bugs Cyber Risks ·
DISGOMOJI Malware Used to Target Indian Government Cyber Risks ·
CVE-2022-0995: Linux Kernel Out-of-Bounds Write Vulnerability Known Exploited Vulnerabilities · Aug 26, 2026