UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
Cisco Talos exposes UAT-10147, a Chinese-speaking group using AI tools to automate intrusions, deploy SPECTRE, BadIIS, and rootkits against web servers worldwide.
Cisco Talos detailed UAT-10147, a Chinese-speaking cybercrime group conducting SEO fraud and data theft against Windows and Linux web servers in education, media, technology, and gaming sectors, with most victims in Brazil, Bolivia, China, Canada, and Vietnam. The actor exploits publicly disclosed vulnerabilities for initial access, including Zimbra (CVE-2022-27925) and Alibaba Nacos (CVE-2021-29441), and abuses Linux LPE flaws like CVE-2022-0847 and CVE-2021-3156 for root. Its toolset includes AI-assisted frameworks DeepAudit and PentestGPT, plus implants such as SPECTRE, BadIIS, Quasar RAT, Gh0stCringe, and Noodle RAT. An exposed directory contained a target list of roughly 170,000 URLs, with the US, India, UK, Germany, and Netherlands as top destinations.
- Target list of ~170,000 URLs found on an exposed open directory
- Uses AI tools PentestGPT and DeepAudit for scanning, exploit refinement, and post-exploitation
- Deploys EfsPotato privilege escalation, Defender exclusions, and a scheduled task named Google Chrome Start
- BadIIS operates as malware-as-a-service shared by multiple Chinese-speaking groups
- Exfiltration routed through a legitimate cloud configuration service to blend with admin traffic
- CVEs
- CVE-2022-0995CVE-2021-3156CVE-2015-5287CVE-2015-3246CVE-2010-3904CVE-2022-0847CVE-2022-27925CVE-2021-23758CVE-2019-18935CVE-2021-29441CVE-2021-29442
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1505.003 Web ShellT1053.005 Scheduled TaskT1562.001 Impair Defenses: Disable or Modify Tools
- Vendors
- Cisco Talos
- Products
- BadIIS
- Threat actors
- UAT-10147
- Organizations
- Cisco Talos
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2010-3904 | Local Privilege Escalation in Linux Kernel RDS Implementation | — | 16% | KEV | — KEV |
| CVE-2015-3246 | Race Condition in Red Hat libuser Allows Local Privilege Escalation | 7.4 | 9% | KEVPoC | KEV |
| CVE-2015-5287 | Local Privilege Escalation via Symlink Attack in Red Hat ABRT | — | 5% | KEV | — KEV |
| CVE-2019-18935 | Unauthenticated .NET Deserialization RCE in Progress Telerik UI for ASP.NET AJAX | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2021-23758 | Unauthenticated .NET Deserialization RCE in Ajax.NET Professional (ajaxpro.2) | 9.8 | 83% | KEVPoC ×2 | KEV |
CVE-2021-29441+1 related CVE | Nacos: When configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce… | 9.8 group max | 83% | PoC ×2 | |
| CVE-2021-3156 | Heap-Based Buffer Overflow in Sudo Enables Local Privilege Escalation (CVE-2021-3156) | 7.8 | 100% | KEVPoC ×12 | KEV |
| CVE-2022-0847 | Local Privilege Escalation ('Dirty Pipe') in the Linux Kernel | 7.8 | 93% | KEVPoC ×4 | KEV |
| CVE-2022-0995 | Out-of-Bounds Write in Linux Kernel watch_queue Enables Local Privilege Escalation | 7.8 | 9% | KEVPoC ×2 | KEV |
| CVE-2022-27925 | Authenticated Path Traversal File Upload Leading to RCE in Zimbra Collaboration Suite | 7.2 | 99% | KEVRansomwarePoC | KEV |
From the original article
6 min read at thehackernews.com
Cybersecurity researchers have disclosed details of a Chinese-speaking cybercrime group dubbed UAT-10147 that's targeting Windows and Linux web servers globally across the education, media, technology, and gaming sectors. The vast majority of the targets are located in Brazil, Bolivia, China, Canada, and Vietnam. Details of the threat activity came to light following the discovery of an open directory hosted at "139.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.