# Chinese-speaking threat group UAT-10147 uses agentic AI to automate exploitation of internet-facing web servers

> Cisco Talos identified UAT-10147, a Chinese-speaking financially motivated cybercrime group, using agentic AI systems to automate the exploitation of vulnerable internet-facing web servers running Zimbra, AjaxPro, Nacos, and Telerik software. The group targets Windows IIS and Linux servers across government, education, media, technology, and gaming sectors, deploying multiple malware families including BadIIS, SPECTRE, QuasarRAT, NoodleRAT, and Gh0stCringe. A linked attacker server contained a target list of approximately 170,000 URLs split across 17 files.

- **Published:** 2026-08-21T00:00:00Z
- **Last reviewed:** 2026-08-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2096
- **ID:** TL-2026-2096
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** UAT-10147 (China)
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2022-27925, CVE-2022-37042, CVE-2021-23758, CVE-2021-29441, CVE-2021-29442, CVE-2019-18935, CVE-2022-0847, CVE-2021-3156, CVE-2022-0995, CVE-2019-16098, CVE-2021-21551, CVE-2015-5287, CVE-2015-3246, CVE-2010-3904

## Description

Cisco Talos identified UAT-10147 (tracked since early 2026) as an emerging class of financially motivated intrusion operators integrating agentic AI into the full attack lifecycle. The group targets vulnerable internet-facing web servers globally, exploiting one-day vulnerabilities in Zimbra Collaboration Suite (CVE-2022-27925), AjaxPro .NET framework (CVE-2021-23758), Alibaba Nacos configuration service (CVE-2021-29441, CVE-2021-29442), and Progress Telerik UI for ASP.NET AJAX (CVE-2019-18935) for initial access.

On Windows IIS servers, the post-exploitation chain deploys a main script (back.txt/back.bat) via certutil that downloads privilege escalation tools (EfsPotato renamed as prcc1.rar), installs BadIIS malicious IIS modules for SEO fraud, deploys QuasarRAT disguised as svchosts.exe, and establishes persistent ASHX web shells. The group adds Windows Defender exclusions for IIS directories via PowerShell and registry, creates rogue local admin accounts, and establishes persistence through scheduled tasks named 'Google Chrome Start'.

On Linux servers, initial access is followed by web shell deployment and privilege escalation using multiple Linux kernel exploits including Dirty Pipe (CVE-2022-0847), Baron Samedit sudo heap overflow (CVE-2021-3156), watch_queue out-of-bounds write (CVE-2022-0995), and older LPE vulnerabilities. Post-exploitation implants include SPECTRE (a cross-platform C2 implant with a kernel-level rootkit named 'Specter'), NoodleRAT backdoor, and Meterpreter.

The group's most distinctive capability is its use of agentic AI across the full attack cycle, not merely for code generation. Talos recovered AI-generated Python scripts for diagnostics (check_paths.py), implant deployment (deploy_implant.py), web shell installation (deploy_shell.py), and recon/exfiltration (exfil.py). The AI assisted in troubleshooting failed exploits, generating a 9-section ASP.NET ViewState deserialization guide (covering MachineKey validation, ysoserial payload generation, OOB callback confirmation, and post-exploitation recon), and producing exploit validation workflows. The ASP.NET deserialization guide specifically documents that TypeConfuseDelegate gadget chain remains functional on .NET 4.8 despite public claims otherwise, and that HTTP 500 with InvalidCastException indicates successful exploitation (creating a monitoring blind spot).

The SPECTRE implant, a C-based cross-platform backdoor, represents the group's most sophisticated tool. On Windows, it features dual-layer anti-analysis (PEB hash walking for API resolution, per-string xorshift32 PRNG encryption), 45 commands (24 plaintext, 21 encrypted), three process injection methods (hollowing, APC EarlyBird, self-hollowing into RuntimeBroker.exe), credential theft via SAM hive dump, Chrome/Edge DPAPI theft, and Windows Credential Manager enumeration. It uses BYOVD (Bring Your Own Vulnerable Driver) via RTCore64.sys (CVE-2019-16098) and DBUtil_2_3.sys (CVE-2021-21551) to achieve kernel-level EDR bypass, neutralizing CrowdStrike Falcon, SentinelOne, and Microsoft Defender by unlinking PspCreateProcessNotifyRoutine, PspCreateThreadNotifyRoutine, and PspLoadImageNotifyRoutine callbacks. On Linux, SPECTRE is statically linked with an 8-factor anti-sandbox scoring engine, deploys a kernel rootkit disguised as acpi_pad.ko, uses ftrace to hook six syscall handlers, and achieves persistence via a systemd unit that loads before sysinit.target.

Infrastructure analysis reveals the group operates a download/C2 server at 139.180.197.150 (Vultr Tokyo, Japan, in a subnet with multiple confirmed Cobalt Strike and ShadowPad C2 servers), the domain adminapi.tippusoni.in for BadIIS distribution, and uses webhook.site as an exfiltration endpoint to blend with legitimate SaaS traffic. The group also leverages Nacos's configuration management service as an asynchronous exfiltration sink. AI tools recovered include DeepAudit (source code vulnerability scanning), PentestGPT (dynamic scanning with PoC execution), ysoserial (.NET deserialization payload generation), and badsecrets (MachineKey leakage detection). The actor's machine contained a desktop folder path C:\Users\dajiba\Desktop\phantom-v2\data\arsenal\webshells\sss.ashx, with dajiba (pinyin for a Chinese profanity) as the username. Development artifacts suggest the alias x神 (xshen) in PDB paths for BadIIS variants.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1203 Exploitation for Client Execution
- T1106 Native API
- T1505.003 Server Software Component: Web Shell
- T1505.002 Transport Agent
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1136.001 Create Account: Local Account
- T1543.002 Create or Modify System Process: Systemd Service
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1014 Rootkit
- T1134.001 Access Token Manipulation: Token Impersonation/Theft
- T1055.012 Process Injection: Process Hollowing
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 Indicator Removal: File Deletion
- T1070.006 Indicator Removal: Timestomp
- T1564.001 Hide Artifacts: Hidden Files and Directories
- T1055.001 Dynamic-link Library Injection
- T1055.004 Asynchronous Procedure Call
- T1036.005 Match Legitimate Resource Name or Location
- T1497 Virtualization/Sandbox Evasion

## Sources

- [Cisco Talos: UAT-10147 Chinese-speaking adversary integrates agentic AI into post-compromise operations](https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/)
- [Cisco Talos: UAT-10147 deploys SPECTRE cross-platform implant with Linux rootkit and BYOVD capabilities](https://blog.talosintelligence.com/uat-10147-deploys-spectre-a-cross-platform-implant-with-linux-rootkit-and-byovd-capabilities/)
- [Cyber Security News: Chinese Hackers Use AI Agents to Exploit Web Servers and Automate Attacks](https://cybersecuritynews.com/chinese-hackers-use-ai-agents/)
- [NVD: CVE-2022-27925 (Zimbra Directory Traversal RCE)](https://nvd.nist.gov/vuln/detail/CVE-2022-27925)
- [Volexity: Mass Exploitation of Unauthenticated Zimbra RCE](https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/)
- [NVD: CVE-2021-23758 (AjaxPro Deserialization RCE)](https://nvd.nist.gov/vuln/detail/CVE-2021-23758)
- [MOGWAI LABS: Vulnerability Spotlight RCE in Ajax.NET Professional](https://mogwailabs.de/en/blog/2022/01/vulnerability-spotlight-rce-in-ajax.net-professional/)
- [NVD: CVE-2019-18935 (Telerik UI Deserialization RCE)](https://nvd.nist.gov/vuln/detail/CVE-2019-18935)
- [CISA: Known Exploited Vulnerabilities - CVE-2019-18935](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Dirty Pipe: CVE-2022-0847 (CM4all/Max Kellermann)](https://dirtypipe.cm4all.com/)
- [Qualys: CVE-2021-3156 Baron Samedit Sudo Heap Buffer Overflow](https://blog.qualys.com/vulnerabilities-threat-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit)
- [Palo Alto Unit 42: Operation Rewrite SEO Poisoning Campaign](https://unit42.paloaltonetworks.com/operation-rewrite-seo-poisoning-campaign/)
- [Cisco Talos: UAT-8099 Chinese-speaking cybercrime group SEO fraud](https://blog.talosintelligence.com/uat-8099-chinese-speaking-cybercrime-group-seo-fraud/)
- [Cisco Talos: MaaS BadIIS ecosystem tracking](https://blog.talosintelligence.com/from-pdb-strings-to-maas-tracking-a-commodity-badiis-ecosystem/)
- [CISA AA22-228A: Exploitation of Zimbra Collaboration Suite](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-228a)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2096