- Published on
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
- Authors
- Name
- DeepHorus
Cybersecurity researchers have uncovered a Chinese-speaking cybercrime group, designated UAT-10147, launching large-scale attacks against Windows and Linux web servers globally. The group's primary targets are in the education, media, technology, and gaming sectors, with a significant concentration of victims in Brazil, Bolivia, China, Canada, and Vietnam. The investigation was triggered by the discovery of an open directory at the IP address 139.180.197[.]150, which was linked to a compromised machine.
UAT-10147 operates with a focus on SEO fraud and data theft. According to a report from Cisco Talos, the group leverages publicly disclosed vulnerabilities at scale for initial access. They employ a mix of open-source offensive tools, including Metasploit and ysoserial, to automate their intrusion operations.
A key innovation of this threat actor is the integration of artificial intelligence (AI) throughout the attack lifecycle. AI tools are used to refine exploits, troubleshoot logic, generate payloads, and create operational documentation. This approach indicates a deliberate effort to implement offensive tradecraft at an industrial scale.
The scale of their operation is substantial. An analysis of the exposed directory revealed a target list containing approximately 170,000 URLs. The attacker organized this list into 17 files for more efficient processing, with the top target nations being the United States, India, the United Kingdom, Germany, and the Netherlands.
The attack chains are highly automated. They typically begin by exploiting known flaws to gain remote code execution on vulnerable servers. Once inside, automated scripts deploy malware for SEO fraud or data stealing. This often includes installing a web shell, which facilitates the deployment of BadIIS and other backdoors for persistent access.
For Windows systems, the group uses batch scripts to download privilege escalation tools and remote access trojans like Quasar RAT. They then employ tactics like configuring Defender exclusions and creating deceptive scheduled tasks for persistence. For Linux systems, they exploit multiple known CVEs to escalate to root before deploying backdoors such as Noodle RAT and a new implant called SPECTRE.
The use of BadIIS malware is notable as it operates under a malware-as-a-service model and is shared among several Chinese-speaking cybercrime groups. The group's methods demonstrate a sophisticated, automated approach to compromising servers for financial gain through fraud and theft.
