Chinese-speaking threat group UAT-10147 uses agentic AI to automate exploitation of internet-facing web servers

Chinese-speaking threat group UAT-10147 uses agentic AI to (TL-2026-2096), also tracked as UAT-10147 campaign, is a high-severity tracked intrusion set, first published 2026-08-21. It is attributed to UAT-10147 (China) with medium confidence, affects Synacor Zimbra Collaboration Suite, references 14 CVEs (CVE-2022-27925, CVE-2022-37042, CVE-2021-23758), maps to 25 MITRE ATT&CK techniques (T1014, T1027, T1036.005), and is covered by 9 detection rules and 26 indicators of compromise.

Key facts for TL-2026-2096

Threat ID
TL-2026-2096
Also known as
UAT-10147 campaign
Severity
HIGH
Status
ACTIVE
Category
THREAT_INTEL
First published
2026-08-21
Last reviewed
2026-08-21
Attribution
UAT-10147
Attribution confidence
MEDIUM
Nation-state nexus
China
Motivation
FINANCIAL
Target sectors
government administration, education, news - media, technology, gaming
Target regions
brazil, bolivia, china, canada, vietnam, india, thailand, japan
Detection rules
9
Indicators of compromise
26

Malware and tooling in Chinese-speaking threat group UAT-10147 uses agentic AI to

Malware and tooling: IISpy, Meterpreter (Android), Quasar RAT, DeepAudit, EfsPotato, PentestGPT, SPECTRE

Cisco Talos identified UAT-10147, a Chinese-speaking financially motivated cybercrime group, using agentic AI systems to automate the exploitation of vulnerable internet-facing web servers running Zimbra, AjaxPro, Nacos, and Telerik software. The group targets Windows IIS and Linux servers across government, education, media, technology, and gaming sectors, deploying multiple malware families including BadIIS, SPECTRE, QuasarRAT, NoodleRAT, and Gh0stCringe. A linked attacker server contained a target list of approximately 170,000 URLs split across 17 files.

How Chinese-speaking threat group UAT-10147 uses agentic AI to works

Cisco Talos identified UAT-10147 (tracked since early 2026) as an emerging class of financially motivated intrusion operators integrating agentic AI into the full attack lifecycle. The group targets vulnerable internet-facing web servers globally, exploiting one-day vulnerabilities in Zimbra Collaboration Suite (CVE-2022-27925), AjaxPro .NET framework (CVE-2021-23758), Alibaba Nacos configuration service (CVE-2021-29441, CVE-2021-29442), and Progress Telerik UI for ASP.NET AJAX (CVE-2019-18935) for initial access.

On Windows IIS servers, the post-exploitation chain deploys a main script (back.txt/back.bat) via certutil that downloads privilege escalation tools (EfsPotato renamed as prcc1.rar), installs BadIIS malicious IIS modules for SEO fraud, deploys QuasarRAT disguised as svchosts.exe, and establishes persistent ASHX web shells. The group adds Windows Defender exclusions for IIS directories via PowerShell and registry, creates rogue local admin accounts, and establishes persistence through scheduled tasks named 'Google Chrome Start'.

On Linux servers, initial access is followed by web shell deployment and privilege escalation using multiple Linux kernel exploits including Dirty Pipe (CVE-2022-0847), Baron Samedit sudo heap overflow (CVE-2021-3156), watch_queue out-of-bounds write (CVE-2022-0995), and older LPE vulnerabilities. Post-exploitation implants include SPECTRE (a cross-platform C2 implant with a kernel-level rootkit named 'Specter'), NoodleRAT backdoor, and Meterpreter.

The group's most distinctive capability is its use of agentic AI across the full attack cycle, not merely for code generation. Talos recovered AI-generated Python scripts for diagnostics (check_paths.py), implant deployment (deploy_implant.py), web shell installation (deploy_shell.py), and recon/exfiltration (exfil.py). The AI assisted in troubleshooting failed exploits, generating a 9-section ASP.NET ViewState deserialization guide (covering MachineKey validation, ysoserial payload generation, OOB callback confirmation, and post-exploitation recon), and producing exploit validation workflows. The ASP.NET deserialization guide specifically documents that TypeConfuseDelegate gadget chain remains functional on .NET 4.8 despite public claims otherwise, and that HTTP 500 with InvalidCastException indicates successful exploitation (creating a monitoring blind spot).

The SPECTRE implant, a C-based cross-platform backdoor, represents the group's most sophisticated tool. On Windows, it features dual-layer anti-analysis (PEB hash walking for API resolution, per-string xorshift32 PRNG encryption), 45 commands (24 plaintext, 21 encrypted), three process injection methods (hollowing, APC EarlyBird, self-hollowing into RuntimeBroker.exe), credential theft via SAM hive dump, Chrome/Edge DPAPI theft, and Windows Credential Manager enumeration. It uses BYOVD (Bring Your Own Vulnerable Driver) via RTCore64.sys (CVE-2019-16098) and DBUtil_2_3.sys (CVE-2021-21551) to achieve kernel-level EDR bypass, neutralizing CrowdStrike Falcon, SentinelOne, and Microsoft Defender by unlinking PspCreateProcessNotifyRoutine, PspCreateThreadNotifyRoutine, and PspLoadImageNotifyRoutine callbacks. On Linux, SPECTRE is statically linked with an 8-factor anti-sandbox scoring engine, deploys a kernel rootkit disguised as acpi_pad.ko, uses ftrace to hook six syscall handlers, and achieves persistence via a systemd unit that loads before sysinit.target.

Infrastructure analysis reveals the group operates a download/C2 server at 139.180.197.150 (Vultr Tokyo, Japan, in a subnet with multiple confirmed Cobalt Strike and ShadowPad C2 servers), the domain adminapi.tippusoni.in for BadIIS distribution, and uses webhook.site as an exfiltration endpoint to blend with legitimate SaaS traffic. The group also leverages Nacos's configuration management service as an asynchronous exfiltration sink. AI tools recovered include DeepAudit (source code vulnerability scanning), PentestGPT (dynamic scanning with PoC execution), ysoserial (.NET deserialization payload generation), and badsecrets (MachineKey leakage detection). The actor's machine contained a desktop folder path C:\Users\dajiba\Desktop\phantom-v2\data\arsenal\webshells\sss.ashx, with dajiba (pinyin for a Chinese profanity) as the username. Development artifacts suggest the alias x神 (xshen) in PDB paths for BadIIS variants.

MITRE ATT&CK techniques used in TL-2026-2096

stealth

T1014 Rootkit

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055.001 Dynamic-link Library Injection; T1055.004 Asynchronous Procedure Call; T1070.004 Indicator Removal: File Deletion; T1070.006 Indicator Removal: Timestomp; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564.001 Hide Artifacts: Hidden Files and Directories

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task; T1136.001 Create Account: Local Account; T1505.002 Transport Agent; T1505.003 Server Software Component: Web Shell; T1543.002 Create or Modify System Process: Systemd Service; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Privilege Escalation

T1055.012 Process Injection: Process Hollowing; T1134.001 Access Token Manipulation: Token Impersonation/Theft

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.004 Command and Scripting Interpreter: Unix Shell; T1106 Native API; T1203 Exploitation for Client Execution

Initial Access

T1190 Exploit Public-Facing Application

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Chinese-speaking threat group UAT-10147 uses agentic AI to

  • Synacor — Zimbra Collaboration Suite
    Vulnerable versions: 8.8.15 before P31; 9.0.0 before P24
    Fixed in: 8.8.15 P33+; 9.0.0 P26+
  • AjaxPro — Ajax.NET Professional (ajaxpro.2)
    Vulnerable versions: all prior to 21.10.30.1
    Fixed in: AjaxNetProfessional 21.11.29.1+
  • Alibaba — Nacos
    Vulnerable versions: < 1.4.1 (auth bypass); < 2.4.0 (Derby RCE)
    Fixed in: >= 2.4.0
  • Progress Software — Telerik UI for ASP.NET AJAX
    Vulnerable versions: <= 2019.3.1023
    Fixed in: R1 2020 (2020.1.114+)
  • Linux Kernel — Linux Kernel
    Vulnerable versions: 5.8 - 5.16.10; 5.15 - 5.15.24; 5.10 - 5.10.101
    Fixed in: >= 5.16.11; >= 5.15.25; >= 5.10.102
  • Sudo Project — Sudo
    Vulnerable versions: 1.8.2 - 1.8.31p2; 1.9.0 - 1.9.5p1
    Fixed in: >= 1.9.5p2
  • Microsoft — Windows Server
    Vulnerable versions: Windows Server 2016/2019/2022 with IIS
    Fixed in: N/A (behavioral mitigation)
  • MSI (Micro-Star International) — RTCore64.sys driver
    Vulnerable versions: All versions (CVE-2019-16098)
    Fixed in: Revoked by Microsoft
  • Dell — DBUtil_2_3.sys driver
    Vulnerable versions: All versions (CVE-2021-21551)
    Fixed in: Revoked by Microsoft

Remediation for Chinese-speaking threat group UAT-10147 uses agentic AI to

Patches

  • Zimbra: 8.8.15P33 or 9.0.0P26+ for CVE-2022-27925/CVE-2022-37042
  • AjaxPro: Migrate to AjaxNetProfessional >= 21.11.29.1
  • Nacos: >= 2.4.0
  • Telerik UI: >= 2020.1.114
  • Linux kernel: >= 5.16.11, 5.15.25, or 5.10.102
  • sudo: >= 1.9.5p2

Immediate actions

  • Patch Zimbra Collaboration Suite to latest version (CVE-2022-27925/CVE-2022-37042)
  • Upgrade or migrate AjaxPro.2 to AjaxNetProfessional >= 21.11.29.1
  • Upgrade Alibaba Nacos to version >= 2.4.0
  • Upgrade Telerik UI for ASP.NET AJAX to R1 2020 (2020.1.114) or later
  • Patch Linux kernels to fix CVE-2022-0847 (>= 5.16.11, 5.15.25, 5.10.102)
  • Update sudo to version >= 1.9.5p2 (CVE-2021-3156)
  • Patch Linux kernels for CVE-2022-0995 (>= 5.16.15, 5.15.29, 5.10.106)
  • Block IOC IP 139.180.197.150 and domain adminapi.tippusoni.in at perimeter
  • Conduct sweep for ASHX web shells, unauthorized IIS modules, and suspicious scheduled tasks
  • Review ASP.NET MachineKey storage; rotate if exposed

Workarounds

  • Restrict Nacos admin endpoints to trusted networks only
  • Disable Nacos Derby REST API if not required
  • Implement strict URL allowlisting for certutil.exe download operations
  • Disable Telerik RadAsyncUpload if not required
  • Limit outbound HTTPS to approved destinations at network perimeter
  • Restrict IIS application pool identities to least privilege
  • Implement application allowlisting on IIS servers

Longer-term hardening

  • Deploy EDR with behavioral detection capable of identifying process injection and BYOVD driver loading
  • Implement network monitoring for POST requests to /api/v1/register and /api/v1/output endpoints
  • Monitor for webhook.site outbound connections as potential exfiltration indicator
  • Deploy kernel-level integrity monitoring for ftrace hook detection on Linux systems
  • Implement IIS application pool monitoring for unauthorized module loading
  • Monitor Windows Defender exclusion list modifications via registry and PowerShell
  • Deploy detection for certutil.exe used to download from non-Microsoft domains

CVEs associated with Chinese-speaking threat group UAT-10147 uses agentic AI to

  • CVE-2022-27925
  • CVE-2022-37042
  • CVE-2021-23758
  • CVE-2021-29441
  • CVE-2021-29442
  • CVE-2019-18935
  • CVE-2022-0847
  • CVE-2021-3156
  • CVE-2022-0995
  • CVE-2019-16098
  • CVE-2021-21551
  • CVE-2015-5287
  • CVE-2015-3246
  • CVE-2010-3904

Weaknesses (CWE) in Chinese-speaking threat group UAT-10147 uses agentic AI to

CWE-22, CWE-502, CWE-306, CWE-787, CWE-122, CWE-665

Timeline of Chinese-speaking threat group UAT-10147 uses agentic AI to

  • CISA adds CVE-2019-18935 (Telerik UI) to KEV catalog; UAT-10147 later observed weaponizing this vulnerability
  • CVE-2021-29441 and CVE-2021-29442 Nacos vulnerabilities actively exploited in the wild, later weaponized by UAT-10147
  • CVE-2022-0847 Dirty Pipe disclosed; UAT-10147 later observed using this Linux kernel LPE in their attack chain
  • CISA adds CVE-2021-3156 (Baron Samedit sudo overflow) to KEV catalog
  • CISA adds CVE-2022-0847 Dirty Pipe to Known Exploited Vulnerabilities catalog
  • Mass exploitation of CVE-2022-27925 (Zimbra) begins in the wild, affecting over 1,000 ZCS instances; UAT-10147 weaponizes via Metasploit
  • CISA adds CVE-2022-27925 to Known Exploited Vulnerabilities catalog following Volexity disclosure of mass exploitation
  • CISA due date for federal agencies to patch Zimbra CVE-2022-27925 (still actively exploited as of 2026)
  • Cisco Talos begins tracking UAT-10147 as a distinct intrusion set; group observed operating since at least late 2025
  • Talos identifies UAT-10147 transitioning from AI-assisted scripting to semi-autonomous agentic AI orchestration of post-compromise operations
  • SPECTRE cross-platform implant observed in UAT-10147 operations with BYOVD EDR bypass and Linux Specter rootkit
  • Cisco Talos publishes comprehensive report detailing UAT-10147's agentic AI methodology and SPECTRE implant capabilities
  • Cyber Security News publishes article summarizing UAT-10147 campaign; target list of 170,000 URLs disclosed

Sources cited for Chinese-speaking threat group UAT-10147 uses agentic AI to

More in threat intel

Detection coverage for TL-2026-2096

As of 2026-08-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2096 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats