UAT-10147 AI-Assisted Intrusion and SPECTRE Malware

wpnews.pro

Article Title: UAT-10147: A Chinese-speaking adversary integrates agentic AI into post-compromise operations #

Publisher: Cisco Talos #

Publication Date: 2026-08-20T06:00:00Z #

Severity: High #

Original Source: Cisco Talos #

Threat Actor: UAT-10147 #

CVE: None #

Products & Technologies: Microsoft IIS, Windows, Linux, DeepAudit, ysoserial

#

Executive Summary

After breaching public-facing servers, the threat actor uses AI to speed up the fixing and testing of attack code. They then deploy SPECTRE, rootkits, and existing RATs to Windows and Linux systems.

Reasons for High Severity: A target list of about 170,000 URLs, a wide range of targets including government, education, and technology organizations, cross-platform post-compromise tools for Windows and Linux, and faster repeated attacks supported by AI make this important for SOCs.

#

Attack Flow

Windows Public Web Server Breach

The attacker exploits a known vulnerability in an internet-facing web server to get remote code execution or a web shell.
They use batch files and certutil to download EfsPotato, QuasarRAT, BadIIS, and other tools.
If SeImpersonatePrivilege is available, they try to escalate privileges using EfsPotato and add the IIS directory to the Defender exclusion list.
They list IIS sites using appcmd. Depending on the situation, they set up unauthorized administrator accounts, RDP accounts, persistence tasks, and BadIIS or SPECTRE.
After registration, SPECTRE receives commands via HTTP and sends the results back to the C2.

Linux Public Web Server Breach

They deploy a web shell after getting code execution through a known vulnerability.
They try multiple known Linux privilege escalation methods to expand the breach.
They deploy SPECTRE and the Specter rootkit (which uses ftrace hooks) to hide processes, files, and network traffic.

AI-Assisted Attack Preparation

The attacker manages a target list of about 170,000 URLs and uses AI tools to fix exploit code, analyze the causes of failures, and generate retry steps.
They automate the search for writable paths, ViewState RCE, and web shell deployment using Python scripts that include ysoserial, and check the quality with AI.
DeepAudit was installed on the management server, but there is no direct evidence that the vulnerabilities found by the tool were used in actual attacks.

#

Attacker's Location and Execution Sites

Attack infrastructure and management servers on the internet
Web shells, RATs, and rootkits on the compromised web servers after the breach
AI tools on the attacker's side to support code creation, testing, and troubleshooting

#

Visibility for Victims and Administrators

Victims and Users

General users usually do not need to take any action. The vulnerability in the public web service serves as the entry point.
Users will not easily notice unless there is web defacement or service downtime.

Administrators and SOCs

Administrators may see suspicious outbound HTTP POST requests from the web server, downloads using certutil, IIS configuration listing, and changes to Defender exclusions.
On Windows, suspicious services, high-privilege logon tasks, and RDP accounts are clues. On Linux, suspicious kernel modules are clues.

#

Success and Failure Conditions

Success Conditions

The target is open to the internet and still has exploitable known vulnerabilities.
External communication and tool execution are possible with web server privileges.
Privilege escalation requires vulnerable settings or available high privileges.
Installing a rootkit requires permission to load kernel modules on Linux.

Failure Conditions

Quick patch application on public servers or blocking initial exploitation using a WAF/IPS.
Restricting outbound communication from web processes, certutil, and unknown DLLs or drivers.
Removing SeImpersonatePrivilege and management privileges from web services.
Refusing to load suspicious kernel modules through signature and module controls.

#

What Happens on Success

Arbitrary command execution and long-term remote control on public servers.
Credential theft, process injection, EDR evasion, and IIS traffic manipulation.
Activity hiding via Linux rootkits.
Broad targeting including government, education, media, and technology organizations.

#

Observable Logs

Email

No email-based evidence is shown in public information.

Proxy / SWG / DNS

HTTP POST requests to the SPECTRE C2 and communication to registration and output paths.
Tool downloads from public web servers to unknown IPs or domains.
The attacker's infrastructure connecting to many URLs and vulnerability verification destinations in a short time appears as incoming access on the victim's side.

Endpoint / EDR

certutil, rar extraction, batch execution, EfsPotato, QuasarRAT, BadIIS.
Defender exclusion changes, IIS enumeration via appcmd, creation of suspicious administrator/RDP accounts.
SPECTRE's dynamic API resolution, process injection, BYOVD-related drivers, and Linux's acpi_pad.ko disguised module.

Identity / IdP

New local administrators, RDP logons, and use of service account privileges.

SaaS / Cloud

SaaS compromise is not shown in this incident. If AI service usage logs are available, they can be clues for attack code generation and repeated attempts.

Network

Web shell communication, RAT C2, internal reconnaissance, RDP, and SPECTRE's HTTP C2.

#

Attack Success Determination

Attack Attempt Observed (Success Unconfirmed): Only vulnerability scans or exploit requests to the target URL. If there is no response or subsequent traces, success is unconfirmed. #

Initial Execution Confirmed: Confirmation of commands under web processes, web shell files, or external tool downloads. #

Malware Execution or Authentication Success Confirmed: Execution of SPECTRE, QuasarRAT, BadIIS, or rootkits, or logon by attacker-created accounts. #

Information Theft or Session Compromise Confirmed: Access to credential files or memory, staging of collected data, or outbound transfer. #

Subsequent Compromise Confirmed: Movement to other hosts, EDR evasion, rootkits, additional RATs, or RDP usage.

"Attack Attempt Observed (Success Unconfirmed)" means suspicious requests or deliverables were confirmed, but it does not mean code execution or information theft succeeded. Advance the stage based on subsequent evidence.

#

Investigation Playbook

Trigger

Detection of child processes or outbound communication after exploit requests on public web servers.
Detection of SPECTRE/BadIIS/QuasarRAT or suspicious Linux modules.

Initial Check

Identify the first suspicious HTTP request, target URL, response code, and execution user.
Put created and updated files in the web root and temporary areas in chronological order.

Endpoint

Investigate certutil, appcmd, EfsPotato, Defender exclusions, tasks, services, and local accounts.
On Linux, check kernel modules, ftrace, /tmp, web shells, and persistence.

Authentication & Cloud

Confirm new administrators, RDP, service accounts, and credential usage.
Since cloud compromise is unconfirmed in public info, expand the audit scope only if obtained credentials include cloud permissions.

Subsequent Operations

Search for the same C2, hashes, accounts, and web shells across all environments.
Check IIS settings, drivers, Linux modules, and internal connection destinations.

Containment

Isolate the target server and block outbound C2.
Revoke accounts and credentials, apply patches, and rebuild from a trusted image.

Judgment Categories

Attack attempt only
Initial execution confirmed on web server
Malware execution confirmed
Privilege escalation / defense evasion confirmed
Subsequent compromise confirmed

#

Defense and Detection Ideas

Single Events

Web service parent processes launch certutil, cmd, powershell, or sh.
Addition of Defender exclusions in the IIS directory.
Unknown kernel modules (acpi_pad.ko) or suspicious BYOVD drivers.

Chronological Correlation

Correlate exploit requests -> web shell creation -> tool download -> privilege escalation -> persistence -> C2 on the same host.

Hunting Perspective

New accounts or RDP after site enumeration via appcmd.
NTFS Alternate Data Streams (ADS) in hosts files, high-privilege logon tasks, and rapid deployment of multiple RATs.
Lineage from web processes to modprobe/insmod on Linux.

Log Gaps

Web request bodies, process command lines, Defender configuration changes, driver/module loads, and east-west traffic.

Priority Countermeasures

Vulnerability management and virtual patching for public servers.
Principle of least privilege for web services and egress control.
Driver and kernel module control.
Chronological correlation of web server processes and C2.

#

Facts / Inference / Hypothesis

Facts

UAT-10147 targeted internet-facing web servers on Windows and Linux.
A target list of about 170,000 URLs was managed across 17 files.
AI was used to fix exploit code, analyze failures, test, and create operational documents.
SPECTRE supports Windows and Linux, with features like HTTP C2, process injection, credential theft, and BYOVD.
The Specter rootkit for Linux uses ftrace hooks.
There is no direct evidence that DeepAudit led to the discovery and exploitation of actual vulnerabilities.

Inference

The main benefit of using AI is not creating new intrusion techniques, but speeding up the repetition, fixing, and testing of known methods.
Since multiple RATs are used in the same campaign, correlating attack stages is more effective than relying on a single IOC.

Hypothesis

AI-assisted code may leave repeated similar processes or test fragments, allowing identification by combining code similarity and operational speed.

#

MITRE ATT&CK Mapping

T1190 – Exploit Public-Facing Application (High Confidence) #

T1505.003 – Server Software Component: Web Shell (High Confidence) #

T1105 – Ingress Tool Transfer (High Confidence) #

T1068 – Exploitation for Privilege Escalation (High Confidence) #

T1053.005 – Scheduled Task/Job: Scheduled Task (High Confidence) #

T1562.001 – Impair Defenses: Disable or Modify Tools (High Confidence) #

T1012 – Query Registry (Medium Confidence) #

T1055 – Process Injection (High Confidence) #

T1547.006 – Boot or Logon Autostart Execution: Kernel Modules and Extensions (Medium Confidence): Details of the Specter rootkit and persistence method depend on the environment. #

T1071.001 – Application Layer Protocol: Web Protocols (High Confidence)

#

Unknowns and Additional Investigations

All CVEs used for initial exploitation.
Exact boundaries between AI-generated code and human-created code.
Success or failure of privilege escalation, credential theft, and data exfiltration on each target.
Full distribution scope of SPECTRE and Specter.

#

Impact on SOCs and Organizations

Internet-facing IIS and Linux servers can technically become targets under the same conditions. Instead of trying to guess AI usage itself, SOCs should prioritize connecting web-origin processes, privilege escalations, multiple RATs, drivers/modules, and C2 in a short chronological timeline.

#

Summary by Target Audience

For SOCs Correlate child processes originating from public web servers, multiple RATs, Defender exclusions, drivers/modules, and C2.

For Administrators Quickly update public servers, and minimize web service privileges and outbound communication.

For Users General user operations are not the main entry point. Report any service anomalies to administrators.

source & further reading

dev.to — original article AI Content Labels: Build Trust Signals Before Users Stop Believing the Page PCA Deletes Your Quietest Signals First Amazon Q in Production: 72 Percent Time Saved