UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
-
Researchers have shed light on a Chinese-speaking cybercrime operation tracked as UAT-10147, which is actively targeting Windows and Linux web servers across the globe. The campaign has primarily hit organizations in the education, media, technology, and gaming sectors, with the majority of victims located in Brazil, Bolivia, China, Canada, and Vietnam.
The group's toolset is notable for its scale and sophistication. Attackers are leveraging artificial intelligence to automate and accelerate server compromise, allowing them to spread across a broad range of targets with minimal manual intervention. In addition to AI-driven scanning and exploitation, the operators have deployed SPECTRE, a modular backdoor designed with built-in EDR bypass capabilities to evade endpoint detection and response controls.
For Linux environments, the threat actors have also deployed a custom rootkit to maintain stealth and persistent access on compromised hosts. The rootkit is likely used to hide malicious processes, files, and network connections from system administrators and security tooling.
Key technical highlights from the campaign include:
- AI-assisted reconnaissance and exploitation to identify vulnerable web servers at scale.
- Deployment of the SPECTRE backdoor on Windows systems, featuring EDR evasion techniques.
- A dedicated Linux rootkit for stealthy persistence on compromised Unix-based servers.
- Focus on high-value sectors such as education and technology, with a notable geographic concentration in South America and East Asia.
The findings were made public after researchers discovered an open command-and-control infrastructure linked to the group, which exposed internal operations and tooling. While full attribution remains unclear, the Chinese-speaking origins of the group suggest a highly organized operation with significant development resources.
Source: The Hacker News
Given the use of AI-driven automation and a dedicated Linux rootkit, how is your organization monitoring web server fleets for signs of this kind of stealthy, cross-platform intrusion?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login