UAT-10147

Mentions · 7d0
Mentions · 30d0
All mentions5
First seenAug 20, 2026
Last mentionedSep 8, 2026

Timeline

5 articles · newest first

August 2026 CVE Landscape

Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.

Recorded FutureSep 8, 00:00 UTC · Sep 8, 2026VulnerabilityExploitedCVE-2025-62593 CVE-2026-72898 CVE-2026-9198+44 · 2 reads

UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

Cisco Talos exposes UAT-10147, a Chinese-speaking group using AI tools to automate intrusions, deploy SPECTRE, BadIIS, and rootkits against web servers worldwide.

The Hacker NewsAug 27, 18:33 UTC · Aug 27, 2026Threat actorExploitedCVE-2022-0995 CVE-2021-3156 CVE-2015-5287+87

CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs

CISA added six actively exploited flaws to KEV, led by Citrix NetScaler CVE-2026-8452, with federal patch deadlines set.

The Hacker NewsAug 27, 07:05 UTC · Aug 27, 2026Exploit / PoCExploitedCVE-2019-1068 CVE-2026-8452 CVE-2022-0995+34 · 1 read

UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

Cisco Talos identifies UAT-10147 deploying the SPECTRE implant with cross-platform C2, credential theft, and kernel-level EDR bypass.

Cisco TalosAug 20, 10:00 UTC · Aug 20, 2026Threat actorExploited1 · 1 read

UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations

Cisco Talos tracks UAT-10147, a Chinese-speaking cybercrime group exploiting vulnerable web servers and using agentic AI in post-compromise operations.

Cisco TalosAug 20, 10:00 UTC · Aug 20, 2026Threat actorExploited1 · 1 read

Related CVEs

by mentions

CVE-2021-2375883%9.8
Unauthenticated .NET Deserialization RCE in Ajax.NET Professional (ajaxpro.2)
published Dec 3, 2021michaelschwarz (ajaxpro.2 project) ajaxpro.2 (package)KEVPoC ×2
CVE-2022-09959%7.8
Out-of-Bounds Write in Linux Kernel watch_queue Enables Local Privilege Escalation
published Mar 25, 2022Linux kernelKEVPoC ×2
CVE-2015-32469%7.4
Race Condition in Red Hat libuser Allows Local Privilege Escalation
published Aug 11, 2015Red Hat libuserKEVPoC
CVE-2015-52875%—
Local Privilege Escalation via Symlink Attack in Red Hat ABRT
published —Red Hat Automatic Bug Reporting Tool (ABRT)KEV
CVE-2026-7289899%10.0
Unauthenticated SQL Injection in Metabase Grants Admin Access
published Aug 10, 2026MetabaseKEVPoC ×3
CVE-2026-919829%9.8
Unauthenticated RCE Chain in IBM Langflow OSS 1.0.0-1.10.0
published Jul 17, 2026IBM Langflow OSSKEVPoC
CVE-2019-18935100%9.8
Unauthenticated .NET Deserialization RCE in Progress Telerik UI for ASP.NET AJAX
published Dec 11, 2019Telerik (Progress) UI for ASP.NET AJAXKEVRansomwarePoC ×4
CVE-2025-6259360%9.4
Actively Exploited Browser-Based RCE in Ray AI Compute Engine
published Nov 26, 2025Ray-Project (Anyscale) RayKEVPoC
CVE-2026-8157885%8.8
Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
published Aug 28, 2026PaperCut MFKEV
CVE-2021-2944183%9.8
Nacos: When configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce…
published Apr 27, 2021alibaba nacosPoC ×2

Appears with

Cisco Talosvendor · 3
CISAorganization · 2
Cisco Talosorganization · 2
BadIISproduct · 2
Red Hat libuserproduct · 2
Red Hatvendor · 2
SPECTREmalware · 2
Ajax.NET Professionalproduct · 2
Microsoftvendor · 2
Microsoft SQL Serverproduct · 2
IBM Langflowvendor · 1
Citrixvendor · 1
Metabaseproduct · 1
Red Hat ABRTproduct · 1
PaperCut NG/MFproduct · 1
Zimbravendor · 1

Entities are extracted by the model from each article. First seen Aug 20, 2026, last mentioned Sep 8, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.