A Chinese-speaking cybercrime group tracked as UAT-10147 is using artificial intelligence to industrialize attacks against Windows and Linux servers, combining AI-assisted exploitation with established offensive frameworks, privilege-escalation tools and a sophisticated cross-platform backdoor capable of disabling endpoint security.
Cisco Talos says the group has targeted servers worldwide across the education, media, technology and gaming sectors, with significant activity observed in Brazil, Bolivia, China, Canada and Vietnam. An exposed attacker-controlled directory also contained a target list of roughly 170,000 URLs, illustrating the scale at which the operation is being prepared.
AI becomes part of the attack pipelineWhat makes UAT-10147 notable is not simply that criminals are experimenting with generative AI. Researchers found AI being incorporated across several stages of the intrusion process, including exploit refinement, reconnaissance, troubleshooting, payload generation, validation and post-exploitation automation.
The group uses tools such as PentestGPT and DeepAudit alongside established offensive frameworks including Metasploit and ysoserial. PentestGPT was installed directly on the attackers’ command-and-control infrastructure and used to scan web servers and test proof-of-concept exploits. Talos also identified several Python utilities that appear to have been AI-generated, including scripts for diagnosing failed web-shell deployments and automating exploitation workflows.
This represents a practical use of AI in cybercrime rather than a fundamentally new attack technique. The models help attackers automate repetitive technical work, troubleshoot failures and adapt existing exploits more efficiently, allowing relatively conventional intrusion techniques to be applied across a much larger target set.
Known vulnerabilities provide the initial accessUAT-10147 primarily gains entry by exploiting publicly disclosed vulnerabilities rather than relying on unknown zero-days. The group has weaponized flaws affecting products including Zimbra, AjaxPro, Telerik UI for ASP.NET AJAX and Alibaba Nacos.
Once remote code execution is achieved, automated scripts deploy additional tools and establish persistence. On Windows systems, the attackers have used EfsPotato for privilege escalation before configuring Microsoft Defender exclusions and installing malware such as Quasar RAT, Gh0stCringe and BadIIS. Scheduled tasks with legitimate-looking names such as “Google Chrome Start” are used to maintain access.
Linux attacks follow a similar pattern. The group exploits known vulnerabilities to obtain initial access and then chains older local privilege-escalation flaws to reach root. Once privileged access is available, additional backdoors—including Noodle RAT, Meterpreter and UAT-10147’s own SPECTRE implant—can be installed.
SPECTRE provides cross-platform controlThe centerpiece of the operation is SPECTRE, a previously undocumented cross-platform backdoor written in C. Talos traces its use to at least April 2026 and describes it as a substantial evolution in commodity intrusion tooling.
The Windows version supports as many as 45 commands, allowing attackers to manipulate files, record keystrokes, capture screenshots, execute shell commands, steal information and inject code into other processes. It also incorporates process hollowing and Early Bird APC injection techniques while using multiple anti-analysis mechanisms to avoid security researchers and automated sandboxes.
More significantly, SPECTRE contains functionality specifically designed to interfere with endpoint detection and response products.
SPECTRE can blind EDR softwareOn Windows, the malware uses a Bring Your Own Vulnerable Driver (BYOVD) technique involving known-vulnerable MSI and Dell drivers. After obtaining kernel-level privileges, SPECTRE can manipulate kernel structures associated with security-product callbacks.
According to Talos, this can prevent products such as CrowdStrike Falcon, SentinelOne and Microsoft Defender from receiving information about new processes, threads and loaded images. Rather than simply terminating an antivirus process—which defenders might immediately notice—the malware attempts to undermine the mechanisms those security products rely on for visibility.
The Linux version takes a similarly aggressive approach. It supports 29 commands and can install a kernel-level rootkit called Specter, providing persistent control while concealing malicious activity from user-space security tools. Researchers suspect the rootkit was developed through a combination of human expertise and AI assistance, based partly on unusual characteristics in its source code and the presence of multiple alternative implementations for similar tasks.
AI is making conventional attacks easier to scaleUAT-10147 is significant because the campaign demonstrates a realistic direction for AI-enabled cybercrime. The attackers are not relying on an autonomous model to discover revolutionary vulnerabilities or independently compromise networks. Instead, AI is being inserted into an existing offensive workflow to make individual stages faster and easier to automate.
A target list containing 170,000 URLs makes that advantage particularly relevant. At that scale, manually troubleshooting every failed exploit or adapting scripts to different server configurations becomes expensive. AI-assisted tools can help attackers analyze failures, modify payloads, generate supporting scripts and document procedures without requiring the same amount of manual work from experienced operators.
The result is essentially an increase in attacker productivity. Techniques that security teams already understand—known-vulnerability exploitation, web shells, privilege escalation, persistence and credential theft—can potentially be deployed against considerably larger numbers of systems.
An automation problem as much as an AI problemThe campaign also reinforces the importance of basic vulnerability management. UAT-10147 relies heavily on vulnerabilities that have already been publicly documented, including several that are years old. AI makes exploitation more efficient, but it still requires vulnerable infrastructure to attack.
Organizations can therefore reduce much of the risk through familiar controls: promptly patch internet-facing servers, remove unnecessary exposure, monitor unusual privilege escalation, restrict administrative access and detect unexpected kernel drivers or web shells.
What UAT-10147 changes is the economics surrounding those weaknesses. A vulnerability that once required attackers to spend significant time developing and adapting tooling can increasingly become part of an automated pipeline combining vulnerability scanners, offensive frameworks and AI-generated scripts.
The emerging threat is not necessarily that AI has invented a new form of hacking. It is that AI can help cybercriminals perform existing attacks faster, against more targets and with increasingly sophisticated tooling such as SPECTRE available at the end of the intrusion chain.
Original report at The Hacker News