BadIIS

Mentions · 7d0
Mentions · 30d0
All mentions2
First seenAug 20, 2026
Last mentionedAug 27, 2026

Timeline

2 articles · newest first

UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

Cisco Talos exposes UAT-10147, a Chinese-speaking group using AI tools to automate intrusions, deploy SPECTRE, BadIIS, and rootkits against web servers worldwide.

The Hacker NewsAug 27, 18:33 UTC · Aug 27, 2026Threat actorExploitedCVE-2022-0995 CVE-2021-3156 CVE-2015-5287+87

UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations

Cisco Talos tracks UAT-10147, a Chinese-speaking cybercrime group exploiting vulnerable web servers and using agentic AI in post-compromise operations.

Cisco TalosAug 20, 10:00 UTC · Aug 20, 2026Threat actorExploited1 · 1 read

Related CVEs

by mentions

CVE-2019-18935100%9.8
Unauthenticated .NET Deserialization RCE in Progress Telerik UI for ASP.NET AJAX
published Dec 11, 2019Telerik (Progress) UI for ASP.NET AJAXKEVRansomwarePoC ×4
CVE-2021-2375883%9.8
Unauthenticated .NET Deserialization RCE in Ajax.NET Professional (ajaxpro.2)
published Dec 3, 2021michaelschwarz (ajaxpro.2 project) ajaxpro.2 (package)KEVPoC ×2
CVE-2022-09959%7.8
Out-of-Bounds Write in Linux Kernel watch_queue Enables Local Privilege Escalation
published Mar 25, 2022Linux kernelKEVPoC ×2
CVE-2021-3156100%7.8
Heap-Based Buffer Overflow in Sudo Enables Local Privilege Escalation (CVE-2021-3156)
published Jan 26, 2021SudoKEVPoC ×12
CVE-2022-084793%7.8
Local Privilege Escalation ('Dirty Pipe') in the Linux Kernel
published Mar 10, 2022Linux KernelKEVPoC ×4
CVE-2015-32469%7.4
Race Condition in Red Hat libuser Allows Local Privilege Escalation
published Aug 11, 2015Red Hat libuserKEVPoC
CVE-2022-2792599%7.2
Authenticated Path Traversal File Upload Leading to RCE in Zimbra Collaboration Suite
published Apr 21, 2022Synacor Zimbra Collaboration Suite (ZCS)KEVRansomwarePoC
CVE-2015-52875%—
Local Privilege Escalation via Symlink Attack in Red Hat ABRT
published —Red Hat Automatic Bug Reporting Tool (ABRT)KEV
CVE-2021-2944183%9.8
Nacos: When configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce…
published Apr 27, 2021alibaba nacosPoC ×2
CVE-2021-2944266%7.5
Nacos: The ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the…
published Apr 27, 2021alibaba nacosPoC ×2

Appears with

Cisco Talosvendor · 2
UAT-10147threat actor · 2
Quasar RATmalware · 1
BadIISmalware · 1
Cisco Talosorganization · 1
EfsPotatomalware · 1
Noodle RATmalware · 1
Gh0stCringemalware · 1
PentestGPTmalware · 1
SPECTREmalware · 1
DeepAuditmalware · 1

Entities are extracted by the model from each article. First seen Aug 20, 2026, last mentioned Aug 27, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.