UAT-10147 AI-Assisted Intrusion and SPECTRE Malware
Basic Information - Article Title: UAT-10147: A Chinese-speaking adversary integrates agentic AI into post-compromise operations - Publisher: Cisco Talos - Publication Date: 2026-08-20T06:00:00Z - Severity: High - Original Source: Cisco Talos - Related Sources: UAT-10147 deploys SPECTRE, a cross-platform implant with Linux rootkit and BYOVD capabilities - Related Malware: SPECTRE, Specter, QuasarRAT, BadIIS, Noodle RAT, Gh0stCringe, Meterpreter - Threat Actor: UAT-10147 - CVE: None - Products & Technologies: Microsoft IIS, Windows, Linux, DeepAudit, ysoserial 2. Executive Summary After breaching public-facing servers, the threat actor uses AI to speed up the fixing and testing of attack code. They then deploy SPECTRE, rootkits, and existing RATs to Windows and Linux systems. Reasons for High Severity: A target list of about 170,000 URLs, a wide range of targets including government, education, and technology organizations, cross-platform post-compromise tools for Windows and Linux, and faster repeated attacks supported by AI make this important for SOCs. 3. Attack Flow Windows Public Web Server Breach - The attacker exploits a known vulnerability in an internet-facing web server to get remote code execution or a web shell. - They use batch files and certutil to download EfsPotato, QuasarRAT, BadIIS, and other tools. - If SeImpersonatePrivilege is available, they try to escalate privileges using EfsPotato and add the IIS directory to the Defender exclusion list. - They list IIS sites using appcmd. Depending on the situation, they set up unauthorized administrator accounts, RDP accounts, persistence tasks, and BadIIS or SPECTRE. - After registration, SPECTRE receives commands via HTTP and sends the results back to the C2. Linux Public Web Server Breach - They deploy a web shell after getting code execution through a known vulnerability. - They try multiple known Linux privilege escalation methods to expand the breach. - They deploy SPECTRE and the Specter rootkit (which uses ftrace hooks) to hide processes, files, and network traffic. AI-Assisted Attack Preparation - The attacker manages a target list of about 170,000 URLs and uses AI tools to fix exploit code, analyze the causes of failures, and generate retry steps. - They automate the search for writable paths, ViewState RCE, and web shell deployment using Python scripts that include ysoserial, and check the quality with AI. - DeepAudit was installed on the management server, but there is no direct evidence that the vulnerabilities found by the tool were used in actual attacks. 4. Attacker's Location and Execution Sites - Attack infrastructure and management servers on the internet - Web shells, RATs, and rootkits on the compromised web servers after the breach - AI tools on the attacker's side to support code creation, testing, and troubleshooting 5. Visibility for Victims and Administrators Victims and Users - General users usually do not need to take any action. The vulnerability in the public web service serves as the entry point. - Users will not easily notice unless there is web defacement or service downtime. Administrators and SOCs - Administrators may see suspicious outbound HTTP POST requests from the web server, downloads using certutil, IIS configuration listing, and changes to Defender exclusions. - On Windows, suspicious services, high-privilege logon tasks, and RDP accounts are clues. On Linux, suspicious kernel modules are clues. 6. Success and Failure Conditions Success Conditions - The target is open to the internet and still has exploitable known vulnerabilities. - External communication and tool execution are possible with web server privileges. - Privilege escalation requires vulnerable settings or available high privileges. - Installing a rootkit requires permission to load kernel modules on Linux. Failure Conditions - Quick patch application on public servers or blocking initial exploitation using a WAF/IPS. - Restricting outbound communication from web processes, certutil, and unknown DLLs or drivers. - Removing SeImpersonatePrivilege and management privileges from web services. - Refusing to load suspicious kernel modules through signature and module controls. 7. What Happens on Success - Arbitrary command execution and long-term remote control on public servers. - Credential theft, process injection, EDR evasion, and IIS traffic manipulation. - Activity hiding via Linux rootkits. - Broad targeting including government, education, media, and technology organizations. 8. Observable Logs - No email-based evidence is shown in public information. Proxy / SWG / DNS - HTTP POST requests to the SPECTRE C2 and communication to registration and output paths. - Tool downloads from public web servers to unknown IPs or domains. - The attacker's infrastructure connecting to many URLs and vulnerability verification destinations in a short time appears as incoming access on the victim's side. Endpoint / EDR - certutil, rar extraction, batch execution, EfsPotato, QuasarRAT, BadIIS. - Defender exclusion changes, IIS enumeration via appcmd, creation of suspicious administrator/RDP accounts. - SPECTRE's dynamic API resolution, process injection, BYOVD-related drivers, and Linux's acpi_pad.ko disguised module. Identity / IdP - New local administrators, RDP logons, and use of service account privileges. SaaS / Cloud - SaaS compromise is not shown in this incident. If AI service usage logs are available, they can be clues for attack code generation and repeated attempts. Network - Web shell communication, RAT C2, internal reconnaissance, RDP, and SPECTRE's HTTP C2. 9. Attack Success Determination - Attack Attempt Observed (Success Unconfirmed): Only vulnerability scans or exploit requests to the target URL. If there is no response or subsequent traces, success is unconfirmed. - Initial Execution Confirmed: Confirmation of commands under web processes, web shell files, or external tool downloads. - Malware Execution or Authentication Success Confirmed: Execution of SPECTRE, QuasarRAT, BadIIS, or rootkits, or logon by attacker-created accounts. - Information Theft or Session Compromise Confirmed: Access to credential files or memory, staging of collected data, or outbound transfer. - Subsequent Compromise Confirmed: Movement to other hosts, EDR evasion, rootkits, additional RATs, or RDP usage. "Attack Attempt Observed (Success Unconfirmed)" means suspicious requests or deliverables were confirmed, but it does not mean code execution or information theft succeeded. Advance the stage based on subsequent evidence. 10. Investigation Playbook Trigger - Detection of child processes or outbound communication after exploit requests on public web servers. - Detection of SPECTRE/BadIIS/QuasarRAT or suspicious Linux modules. Initial Check - Identify the first suspicious HTTP request, target URL, response code, and execution user. - Put created and updated files in the web root and temporary areas in chronological order. Endpoint - Investigate certutil, appcmd, EfsPotato, Defender exclusions, tasks, services, and local accounts. - On Linux, check kernel modules, ftrace, /tmp, web shells, and persistence. Authentication & Cloud - Confirm new administrators, RDP, service accounts, and credential usage. - Since cloud compromise is unconfirmed in public info, expand the audit scope only if obtained credentials include cloud permissions. Subsequent Operations - Search for the same C2, hashes, accounts, and web shells across all environments. - Check IIS settings, drivers, Linux modules, and internal connection destinations. Containment - Isolate the target server and block outbound C2. - Revoke accounts and credentials, apply patches, and rebuild from a trusted image. Judgment Categories - Attack attempt only - Initial execution confirmed on web server - Malware execution confirmed - Privilege escalation / defense evasion confirmed - Subsequent compromise confirmed 11. Defense and Detection Ideas Single Events - Web service parent processes launch certutil, cmd, powershell, or sh. - Addition of Defender exclusions in the IIS directory. - Unknown kernel modules (acpi_pad.ko) or suspicious BYOVD drivers. Chronological Correlation - Correlate exploit requests -> web shell creation -> tool download -> privilege escalation -> persistence -> C2 on the same host. Hunting Perspective - New accounts or RDP after site enumeration via appcmd. - NTFS Alternate Data Streams (ADS) in hosts files, high-privilege logon tasks, and rapid deployment of multiple RATs. - Lineage from web processes to modprobe/insmod on Linux. Log Gaps - Web request bodies, process command lines, Defender configuration changes, driver/module loads, and east-west traffic. Priority Countermeasures - Vulnerability management and virtual patching for public servers. - Principle of least privilege for web services and egress control. - Driver and kernel module control. - Chronological correlation of web server processes and C2. 12. Facts / Inference / Hypothesis Facts - UAT-10147 targeted internet-facing web servers on Windows and Linux. - A target list of about 170,000 URLs was managed across 17 files. - AI was used to fix exploit code, analyze failures, test, and create operational documents. - SPECTRE supports Windows and Linux, with features like HTTP C2, process injection, credential theft, and BYOVD. - The Specter rootkit for Linux uses ftrace hooks. - There is no direct evidence that DeepAudit led to the discovery and exploitation of actual vulnerabilities. Inference - The main benefit of using AI is not creating new intrusion techniques, but speeding up the repetition, fixing, and testing of known methods. - Since multiple RATs are used in the same campaign, correlating attack stages is more effective than relying on a single IOC. Hypothesis - AI-assisted code may leave repeated similar processes or test fragments, allowing identification by combining code similarity and operational speed. 13. MITRE ATT&CK
Comments
No comments yet. Start the discussion.