Verticals Targeted: Government, Education, Media, Technology, Gaming
Regions Targeted: Brazil, Bolivia, China, Canada, Vietnam
Executive Summary
Cisco Talos identified an advanced intrusion ecosystem operated by UAT-10147, a Chinese-speaking, financially motivated threat actor targeting internet-facing Windows and Linux servers. The group combines exploitation of known vulnerabilities with AI-assisted offensive workflows, custom malware, open-source tools, and commodity backdoors. Central to recent activity is SPECTRE, a cross-platform backdoor providing extensive post-exploitation, credential theft, process injection, and defense evasion capabilities. On Linux systems, SPECTRE can deploy the Specter kernel rootkit, while its Windows variant incorporates Bring Your Own Vulnerable Driver (BYOVD) functionality capable of neutralizing endpoint detection and response (EDR) visibility.
Key Takeaways
- UAT-10147 is a Chinese-speaking, financially motivated threat actor targeting internet-facing Windows and Linux servers through publicly disclosed vulnerabilities, with a target list containing approximately 170,000 URLs.
- The group deploys SPECTRE, a cross-platform backdoor supporting credential theft, process injection, privilege escalation, anti-analysis, and advanced defense evasion, including BYOVD-based EDR neutralization on Windows.
- On Linux, SPECTRE can deploy the Specter kernel rootkit, which provides kernel-level process and module hiding, privilege escalation, and persistent access while using legitimate ftrace functionality to reduce detection.
- UAT-10147 integrates AI into exploitation and post-compromise operations, including reconnaissance, exploit refinement and validation, troubleshooting, payload deployment, and operational documentation, while Cisco Talos assesses that AI assistance also contributed to development of the Specter rootkit.
What is SPECTRE?
SPECTRE is a custom backdoor written in C with separate Windows and Linux variants. The Windows version emphasizes anti-analysis and defense evasion, resolving APIs dynamically through Process Environment Block (PEB) hash walking and encrypting sensitive strings using a per-string xorshift32 pseudorandom number generator scheme. SPECTRE also performs weighted anti-analysis checks based on factors including system memory, CPU cores, disk capacity, suspicious processes, sandbox hostnames and usernames, and sleep acceleration. The implant terminates when its cumulative anti-analysis score reaches a defined threshold.
SPECTRE communicates with C2 infrastructure using HTTP POST requests. Cisco Talos identified one Windows version capable of retrieving C2 configuration from an NTFS Alternate Data Stream (ADS), allowing operators to modify infrastructure without recompiling the implant. The Windows variant supports 45 commands covering system reconnaissance, file manipulation, shell execution, screenshots, credential theft, process injection, privilege escalation, keylogging, in-memory .NET assembly execution, and kernel-level defense evasion.
SPECTRE provides three process injection mechanisms: conventional process hollowing, APC EarlyBird injection, and automated self-hollowing into `RuntimeBroker.exe`. It can also obtain SYSTEM privileges through named pipe impersonation and dump the SAM, SYSTEM, and SECURITY registry hives for offline credential extraction. Additional functionality enumerates Windows Credential Manager entries and collects Chrome and Edge login data for subsequent decryption.
BYOVD and EDR Neutralization
One of SPECTRE's most significant Windows capabilities is an integrated BYOVD-based EDR killer. The malware can retrieve either the vulnerable MSI `RTCore64.sys` driver associated with CVE-2019-16098 or Dell's `DBUtil_2_3.sys` driver associated with CVE-2021-21551. It installs the selected driver as a temporary kernel service and abuses its kernel read/write capabilities.
SPECTRE subsequently locates the Windows kernel and calculates addresses associated with process, thread, and image-load notification routines. It can unlink registered EDR callbacks, disrupting the telemetry security products rely upon to observe new processes, threads, and loaded images. Cisco Talos reports that this technique can effectively blind affected EDR products for the remainder of the compromised system's session.
Linux SPECTRE and the Specter Rootkit
The Linux SPECTRE variant is a statically linked x86-64 ELF that implements similar anti-sandbox and C2 functionality but contains a smaller set of 29 commands. Its most significant capability is deployment of the associated Specter Linux kernel rootkit. Specter is installed as a loadable kernel module disguised as the legitimate-looking `acpi_pad.ko` and establishes persistence through a fraudulent `hardware-monitor.service` systemd unit. The service executes before `sysinit.target`, allowing the rootkit to initialize during boot before security tooling.
Specter provides kernel-level process hiding, module concealment, and privilege escalation to UID 0. Rather than directly modifying the system call table, the rootkit abuses the legitimate Linux ftrace instrumentation framework to redirect execution across multiple syscall handlers. This design reduces artifacts that could otherwise expose kernel tampering to integrity monitoring.
AI-Assisted Offensive Operations
UAT-10147 demonstrates extensive integration of AI into its intrusion workflow. Cisco Talos assesses with moderate-to-high confidence that the group represents an emerging class of financially motivated operators using agentic AI to operationalize offensive techniques at scale. Observed applications include iterative exploit refinement, adaptive troubleshooting, exploit validation, post-exploitation automation, and operational documentation generation.
Cisco Talos identified DeepAudit and PentestGPT on actor-controlled infrastructure and observed PentestGPT dynamically scanning web servers and executing relevant proof-of-concept exploits. Recovered artifacts also included AI-generated documentation and Python tooling supporting ASP.NET ViewState exploitation, reconnaissance, implant deployment, web shell installation, and data exfiltration. The workflows incorporated validation and fallback mechanisms, allowing the actor to troubleshoot failed stages and verify successful exploitation and payload deployment.
Cisco Talos noted AI-assisted development contributed to the Specter rootkit. Researchers identified unusually structured documentation, highly uniform code organization, explanatory comments, and multiple implementation approaches consistent with AI-generated code. However, Cisco Talos assesses that human expertise was also involved in the rootkit's development.
Who is UAT-10147?
Cisco Talos began tracking UAT-10147 in early 2026 after identifying activity associated with compromised web servers. The Chinese-speaking cybercrime group is primarily financially motivated and conducts multiple forms of malicious activity, including search engine optimization (SEO) fraud and data theft. UAT-10147 targets vulnerable internet-facing infrastructure across Windows and Linux environments, with observed victims in Brazil, Bolivia, China, Canada, and Vietnam. Affected organizations span government, education, media, technology, and gaming sectors. Cisco Talos also discovered a target list containing approximately 170,000 URLs on actor-controlled infrastructure, indicating the group conducts intrusion activity at significant scale.
The group primarily gains initial access by exploiting publicly disclosed vulnerabilities that enable remote code execution (RCE). Following exploitation, UAT-10147 deploys automated scripts, web shells, privilege escalation tools, and persistent backdoors. Its broader toolkit includes BadIIS, QuasarRAT, Gh0stCringe, Noodle RAT, Meterpreter, and multiple members of the Potato privilege escalation family.
Analyst Commentary
UAT-10147 illustrates a notable evolution in how financially motivated threat actors can incorporate generative and agentic AI into established intrusion operations. The primary concern is not that AI has independently produced a novel class of attack, but that it can reduce the time, effort, and specialized knowledge required to assemble, troubleshoot, validate, and scale existing offensive techniques. UAT-10147 continues to rely heavily on established vulnerabilities, publicly available exploitation frameworks, commodity malware, and known privilege escalation techniques. However, AI-assisted workflows appear to help connect these components into a more efficient end-to-end intrusion process.
Defenders should avoid treating AI-generated or AI-assisted malware as a fundamentally distinct threat category. Regardless of whether portions of SPECTRE, Specter, exploitation scripts, or supporting documentation were produced with AI assistance, the resulting artifacts must still execute on victim systems and perform observable malicious behaviors. In this campaign, those behaviors include vulnerable-driver deployment, process injection, credential collection, registry modification, web shell installation, privilege escalation, persistence creation, suspicious outbound communications, and kernel manipulation.
UAT-10147's combination of commodity and open-source tooling with custom malware, kernel-level defense evasion, and AI-assisted workflows illustrates a narrowing operational gap between conventional financially motivated cybercrime and more technically sophisticated intrusion activity. AI does not eliminate the need for attacker expertise, but it can amplify that expertise by accelerating development and operationalizing techniques across larger target sets. For defenders, the practical challenge is therefore less about detecting whether malware was created with AI and more about maintaining sufficient behavioral, file-based, and infrastructure visibility to identify malicious activity regardless of how the underlying tooling was produced.
PolySwarm can provide additional visibility into malware and suspicious artifacts associated with this kind of activity by leveraging a crowdsourced ecosystem of independent detection engines. Security teams can use PolySwarm to analyze suspicious files and compare detection verdicts across multiple engines, helping identify malicious artifacts that may be missed or inconsistently classified by individual security products. PolySwarm's threat intelligence capabilities can also support investigation and enrichment of malware samples and associated indicators, providing additional context for prioritizing threats and strengthening detection coverage as UAT-10147 and similar actors continue to evolve their tooling.
IOCs
PolySwarm has multiple samples associated with this activity.
008f28989917a9712657de5675fc024b65cb27536734e9b54ea6c3af00ea70f2
11ccfdfb0dfe782ba0eeabaa8e65619a792f9258476a072b774ef19a5240b944
1c2edfb1b280fdc570591c88da5b1adbd249be6b8cc306a42525a515adaf73e8
21274d668e28b01172fa326f42e396b825708ddc2336ae388d6729627c525775
43124b72616ef38b0c8a07b167e971b0e4479626fb5ef2303b2ed993e21f6c4c
50d88f3d8f91f18195f1e9948cf6b47d69d7e19226957b1e7e3b2e4bd7c4fef4
59a386b75b84f137c4e17c37e3430fc93c0184102b3fbdfe649cef2e0335d85b
684e7ed556dcc9e2fe24fcfd73e6b9c29d7126584f87c5331c2607d39e29329f
76df454fe87620dd59efb483a56a8b573c7d16207635cf2616a67e25dab57779
77cce6576f93961651133b543948ea3853cc2f06b8c3fd523f6858d6d18ad775
830c6ca21a7da0eed436f8371c8a86baa62ab857a5478a222dd3189645d4d084
91d00ca46d1013c031aa8ff2e54b7b3496bac78f6147842766bffd4d32a2e042
7565a5bc56fcd94c7f52cf7428747cd4f52d0d3b485900d3d9b06b470ccba23b
b74beab9dac9ee7853b5e846eec6f778db01867b49f64d6be259ea9e19006121
bfbd1aa2c0ace1575e86dc5cedc0754e4ae4aae97e70ac9f0523a2e8e8b22ed9
c88dab534081650d5a385f9bc5c61eced41b4e9fe63ace6173aa536c4aaffa67
cf0a6353f1fccf63fca02ed41eafd3da8d55f77b8b4c45666a37fa3cdc33da55
41f1514ad52c870bc4b51291cb939067e8ace23ec308419253ee0a2497bf2e21
dd4c16c65513c3eb66691f87d5bb5595d38554395ec89be2b9e325e013ef53d5
dee976f262498184d746cc8305cc9e6905ad762c661df8d7daec120f14060b41
e315f955a9b44a9c875d2e47f2a91e9e77043bd553ad616ada38eaf669d44b2e
58725b8e592435026928c39622f41b7ad4f4dc62e353eb459c3b4858eafd9e82
544a7d9d4de3904ad35e6cc87f34cb556fda722c3d3cae1a6334645f1a950cc7
9a8e9d587b570d4074f1c8317b163aa8d0c566efd88f294d9d85bc7776352a28
722bd55e1496cb614f4f365a4203da6166c637f2c6b9ec0da3844637bc6e9e9d
23a7adda56e2e5519e01f57f16f99e4be611aac4fa908f2ee2d99e3d96e14865
f07d869ddd17d4359e26da43574d0d07987b500a390196b72b3c1747a4cbb3bf
d0da3be9de8e7068a65247b8195d73e88f454820e13c1de62675e1f845d6fabf
0f56c703e9b7ddeb90646927bac05a5c6d95308c8e13b88e5d4f4b572423e036
7172ebfb4e96e3b0bff59e87f670c5512144d445b276746c8c78593272720ebf
b02664c71d1a40760ff6eb253d1a9022d93262698d528d95e8983bf848b8827b
1c70b2a55b6f3a3382f40fe15293b609d047103b0c6c7da0049f7c0e365ea880
089b19f7760a53272f580432460dc959cbb8ffb87bde43152795ff5d893debdd
1fc83b41d201bfbc4db94e332e0c770be9d74591d9817c1b938ccdf17c7a48a9
fea09e46f6adf23aa17c56faa14d19168b5417ed90d7b2b36f2c8dd5f6014ea7
061b765659bf24b62d242d4f8ca9a9884037e186714517509a8f48b54e1123a0
Don’t have a PolySwarm account? Go here to sign up for a free Community plan or subscribe.
Contact us at hivemind@polyswarm.io | Check out our blog | Subscribe to our reports.
