The group's toolset is notable for its scale and sophistication. Attackers are leveraging artificial intelligence to automate and accelerate server compromise, allowing them to spread across a broad range of targets with minimal manual intervention. In addition to AI-driven scanning and exploitation, the operators have deployed SPECTRE, a modular backdoor designed with built-in EDR bypass capabilities to evade endpoint detection and response controls.

For Linux environments, the threat actors have also deployed a custom rootkit to maintain stealth and persistent access on compromised hosts. The rootkit is likely used to hide malicious processes, files, and network connections from system administrators and security tooling.

Key technical highlights from the campaign include:

• AI-assisted reconnaissance and exploitation to identify vulnerable web servers at scale.
• Deployment of the SPECTRE backdoor on Windows systems, featuring EDR evasion techniques.
• A dedicated Linux rootkit for stealthy persistence on compromised Unix-based servers.
• Focus on high-value sectors such as education and technology, with a notable geographic concentration in South America and East Asia.

The findings were made public after researchers discovered an open command-and-control infrastructure linked to the group, which exposed internal operations and tooling. While full attribution remains unclear, the Chinese-speaking origins of the group suggest a highly organized operation with significant development resources.

Source: The Hacker News

Given the use of AI-driven automation and a dedicated Linux rootkit, how is your organization monitoring web server fleets for signs of this kind of stealthy, cross-platform intrusion?