Verticals Targeted: Government, Education, Media, Technology, Gaming
Regions Targeted: Brazil, Bolivia, China, Canada, Vietnam
Executive Summary
Cisco Talos identified an advanced intrusion ecosystem operated by UAT-10147, a Chinese-speaking, financially motivated threat actor targeting internet-facing Windows and Linux servers. The group combines exploitation of known vulnerabilities with AI-assisted offensive workflows, custom malware, open-source tools, and commodity backdoors. Central to recent activity is SPECTRE, a cross-platform backdoor providing extensive post-exploitation, credential theft, process injection, and defense evasion capabilities. On Linux systems, SPECTRE can deploy the Specter kernel rootkit, while its Windows variant incorporates Bring Your Own Vulnerable Driver (BYOVD) functionality capable of neutralizing endpoint detection and response (EDR) visibility.