Skip to content

UAT-10147

Summary

Cisco Talos tracks UAT-10147 as a financially motivated, Chinese-speaking intrusion actor that targets internet-exposed Windows and Linux web servers globally, monetizing compromises through SEO fraud and data theft. The actor was first identified in early 2026 after Talos observed a compromised host communicating with a download server (139.180.197[.]150) whose open directory listing exposed the campaign — including a target list of roughly 170,000 URLs. On August 20, 2026 Talos published two reports: one on the campaign's agentic-AI integration and attack chains, and one on the new cross-platform SPECTRE backdoor and the Specter Linux kernel rootkit it carries.

Talos assesses with moderate-to-high confidence that UAT-10147 is part of an emerging class of financially motivated intrusion operators that use agentic AI to operationalize offensive tradecraft at scale — iterative exploit refinement, adaptive troubleshooting, post-exploitation automation, exploit-validation workflows, and operational-documentation generation — marking a transition from AI-assisted scripting toward semi-autonomous offensive orchestration.

Tags

Why this matters

  • This is a web-server intrusion actor, not a supply-chain actor: initial access is public RCEs against IIS / Nginx/Apache deployments, monetized via SEO-fraud modules (BadIIS MaaS, ASHX SeoEngineHandler) and credential / data theft. Defenders should read it through patching and IIS hardening, not package-registry controls.
  • The agentic-AI angle is operationally concrete: recovered artifacts include an AI-generated ASP.NET ViewState RCE guide and four companion Python scripts (check_paths, deploy_implant, deploy_shell, exfil) plus a live findings log confirming RCE on a real target. The durable pattern — machine-key exposure driving a fully scripted, validated exploit loop — is generalizable to any environment that exposes __VIEWSTATE.
  • SPECTRE / Specter adds durable technical tradecraft: a Linux kernel rootkit masquerading as acpi_pad.ko with a Before=sysinit.target systemd unit, ftrace IPMODIFY syscall hooks, and a Windows BYOVD EDR-callback unlink. These are reusable techniques, not just this actor's tools.

Reported activity

  • Early 2026: Talos discovers a Chinese-speaking cybercrime group targeting vulnerable web servers; the actor engages in SEO fraud and data theft.
  • August 20, 2026: Talos publishes the agentic-AI campaign report and the SPECTRE implant report (both by Joey Chen). Affected servers span Brazil, Bolivia, China, Canada, and Vietnam across government, education, media, technology, and gaming sectors.
  • Discovered via OPSEC failure: the actor's C2 download server 139.180.197[.]150 had an open directory listing; the target list (~170,000 URLs in 17 files of ~10,000, "w" = 萬) and AI-generated tooling were recovered from it.

Tools and infrastructure

  • SPECTRE cross-platform C backdoor (Windows 45-command variant; Linux 29-command variant) with Specter kernel rootkit (acpi_pad.ko, hardware-monitor.service, ftrace IPMODIFY, magic PID 31337).
  • BadIIS malware-as-a-service SEO-fraud modules; C# ASHX SeoEngineHandler SEO engine (C2 on vn[.]xyz, targets the Cốc Cốc crawler).
  • Potato family LPE: GodPotato, JuicyPotato, and custom-compiled EfsPotato / RustPotato (PDBs reference ...\Desktop\AI\ build paths).
  • Commodity persistence: QuasarRAT (campaign ID with a derogatory Vietnamese string), Noodle RAT (Type 0x03A2 ELF), Meterpreter, Gh0stCringe (shellcode in a Go loader), and a two-layer web shell authenticating on the X-ID header token x9.
  • AI offensive frameworks on the management/C2 host: DeepAudit, PentestGPT, ysoserial; Metasploit for RCE; exfil via webhook.site and a Nacos config-server async sink.
  • Staging: 139.180.197[.]150 (open dir; secondary web-shell staging on port 54321) and adminapi.tippusoni[.]in (BadIIS dll.zip / user.txt).
  • Exploited vulnerabilities: CVE-2022-27925 (Zimbra), CVE-2021-23758 (AjaxPro), CVE-2021-29441 / -29442 (Nacos), CVE-2019-18935 (Telerik), plus LPEs CVE-2022-0995, CVE-2021-3156, CVE-2015-5287, CVE-2015-3246, CVE-2010-3904, CVE-2022-0847.

Defender notes

  • Treat any acpi_pad.ko on a host without operator-controlled ACPI thermal management, a hardware-monitor.service ordered Before=sysinit.target, or kill() to PID 31337 as hostile by default.
  • Hunt the IIS-exclusion / rogue-local-user / "Google Chrome Start" scheduled-task triad and Nacos-config exfil as concrete artifacts of this chain.
  • For the ViewState surface, audit IIS machineKey confidentiality and alert on the inverted 5xx-success signature (500 containing InvalidCastException on __VIEWSTATE POST = exploit success).

Sources