A Chinese-speaking cybercrime group tracked as UAT-10147 has been observed targeting Windows and Linux web servers globally using AI to scale their operations. The group deploys a malware called SPECTRE along with EDR bypass techniques and a Linux rootkit. Targeted sectors include education, media, technology, and gaming. The majority of victims are located in Brazil, Bolivia, China, Canada, and Vietnam. The threat came to light following the discovery of an open directory or similar exposed infrastructure. The use of AI to scale attacks marks a notable evolution in the group's operational capabilities. The combination of EDR bypass and a Linux rootkit indicates a sophisticated and persistent threat actor capable of evading modern defenses.
UAT-10147 is a Chinese-speaking cybercrime group targeting Windows and Linux web servers globally across education, media, technology, and gaming sectors. The group leverages publicly disclosed vulnerabilities for initial access at scale, integrating AI-powered tools (DeepAudit, PentestGPT) throughout the attack lifecycle for exploitation, reconnaissance, payload generation, validation, and persistence. An exposed directory at 139.180.197[.]150 revealed a target list of approximately 170,000 URLs split into 17 files of ~10,000 each, with top targets in the U.S., India, U.K., Germany, and the Netherlands. Attack chains on Windows involve exploiting known RCE flaws (e.g., Zimbra, AjaxPro, Telerik UI, Alibaba Nacos) to compromise IIS servers, deploying batch scripts via certutil to download EfsPotato (privilege escalation), Quasar RAT, and SPECTRE from remote servers (adminapi.tippusoni[.]in). EfsPotato elevates to SYSTEM and configures Microsoft Defender exclusions. Persistence is established via a scheduled task named 'Google Chrome Start'. BadIIS (a MaaS malware shared among Chinese-speaking groups), Gh0stCringe, and SPECTRE are deployed as follow-on implants. ASP.NET ViewState deserialization (using badsecrets library and ysoserial.net with leaked MachineKeys) is used to achieve RCE, deploy ASHX web shells, and install SPECTRE. Linux attacks use known LPE exploits (CVE-2022-0995, CVE-2021-3156, CVE-2015-5287, CVE-2015-3246, CVE-2010-3904, CVE-2022-0847) to escalate to root, then deploy Noodle RAT, SPECTRE, and Meterpreter. SPECTRE is a cross-platform C-based backdoor first observed in April 2026. Windows version supports 45 commands: file operations, keylogging, screenshots, file upload/download, shell execution, process management, system info, beacon sleep modification, file timestamp modification, shellcode injection, process hollowing, Early Bird APC injection, EDR killing via BYOVD (using RTCore64.sys/CVE-2019-16098 and DBUtil_2_3.sys/CVE-2021-21551), and self-deletion. The BYOVD technique performs targeted kernel writes to unlink EDR callbacks from doubly-linked lists, blinding CrowdStrike Falcon, SentinelOne, Microsoft Defender, and other EDR vendors to process/thread creations and image load events. Linux SPECTRE supports 29 commands covering file system manipulation, system/process reconnaissance, agent management, and shell execution. It includes an integrated kernel-level rootkit ('Specter') loaded as a kernel module providing persistent kernel-level control surviving reboots. Both versions perform anti-sandbox checks using a weighted scoring system (self-terminating if score >50 points) based on process name blocklists, RAM, CPU cores, disk space, sleep acceleration detection, and sandbox hostnames/usernames. Data exfiltration is blended with legitimate SaaS traffic over HTTPS, routed through a cloud-based configuration management service (Alibaba Nacos instance) as an asynchronous exfiltration sink. AI-generated Python scripts assist with post-exploitation diagnostics, SPECTRE deployment, ASHX web shell deployment, and exfiltration traffic blending. The rootkit is suspected to have been developed using AI-assisted development combined with human expertise.
1. Patch immediately: Apply patches for all referenced CVEs, prioritizing CVE-2022-27925 (Zimbra), CVE-2019-18935 (Telerik UI), CVE-2021-23758 (AjaxPro), CVE-2021-29441/29442 (Nacos), and Linux LPE CVEs (CVE-2022-0847 DirtyPipe, CVE-2021-3156 Sudo Baron Samedit). 2. Block vulnerable drivers: Implement driver blocklisting policies to prevent loading of RTCore64.sys (MSI) and DBUtil_2_3.sys (Dell) via Microsoft's Vulnerable Driver Blocklist or similar controls. 3. Rotate ASP.NET MachineKeys: Audit and rotate all ASP.NET MachineKey configurations; use the badsecrets library to identify exposed or known-leaked keys in your environment. 4. Monitor IOCs: Block network connections to 139.180.197[.]150 and adminapi.tippusoni[.]in; monitor for outbound HTTPS traffic to unknown Nacos/cloud config management endpoints. 5. Hunt for malware artifacts: Scan for SPECTRE, Specter rootkit, BadIIS, Gh0stCringe, Noodle RAT, and Quasar RAT on web servers; check for ASHX web shells in IIS webroot directories. 6. Review scheduled tasks: Audit Windows scheduled tasks for deceptive names such as 'Google Chrome Start' and other suspicious entries. 7. Audit IIS configurations: Review IIS site configurations for unauthorized modifications, BadIIS installations, or web shell presence. 8. Enable EDR kernel-level protections: Ensure EDR solutions have kernel-level protection enabled and monitor for BYOVD techniques; consider enabling Secure Boot and HVCI (Hypervisor-Protected Code Integrity) to block vulnerable driver loading. 9. Monitor Linux systems for kernel module installations: Audit loaded kernel modules for unauthorized entries such as 'Specter'; implement kernel module signing enforcement. 10. Restrict certutil usage: Monitor and restrict use of certutil for downloading files from remote servers via policy or endpoint controls. 11. Network segmentation: Restrict outbound connections from web servers to only required endpoints; block connections to known C2 infrastructure. 12. Log and monitor: Enable detailed logging for PowerShell, scheduled tasks, process creation, IIS access, and driver loading events; correlate with SIEM for anomalous patterns consistent with this campaign. 13. Credential protection: Audit privilege tokens, review IIS AppPool identities, and ensure least-privilege principles are enforced.
139.180.197[.]150 (open directory / C2), adminapi.tippusoni[.]in (remote server for payload delivery), RTCore64.sys (MSI vulnerable driver - BYOVD), DBUtil_2_3.sys (Dell vulnerable driver - BYOVD), Scheduled task name: 'Google Chrome Start', SPECTRE (cross-platform C2 backdoor, first seen April 2026), Specter (Linux kernel rootkit module), BadIIS malware, Gh0stCringe malware, Noodle RAT (variant of Gh0st RAT and Rekoobe), Quasar RAT, EfsPotato (privilege escalation tool), DeepAudit (AI-driven vulnerability scanning framework), PentestGPT (autonomous pentesting framework on C2 server), badsecrets library (for ASP.NET MachineKey exploitation), ysoserial.net (deserialization payload generator), ASHX web shell on IIS webroot, spectre_potato() (built-in privilege escalation routine in SPECTRE)
