UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
- ID
- 17168
- Status
- summarized
- Published
- 24 Aug 2026, 4:08 PM
- Fetched
- 24 Aug 2026, 5:45 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/uat-10147-uses-ai-to-scale-server.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 5.5
- Created
- 24 Aug 2026, 5:46 PM
- Tags
- Audience
- developersai_ml_learners
What happened
Cisco Talos disclosed a Chinese-speaking cybercrime group dubbed UAT-10147 that integrates AI tools (PentestGPT, DeepAudit) across the attack lifecycle—reconnaissance, exploit refinement, payload generation, validation, and persistence—targeting Windows and Linux web servers globally across education, media, tech, and gaming sectors. The group compiled a target list of ~170,000 URLs split into 17 files of ~10,000 each, exploiting publicly known vulnerabilities for RCE and deploying web shells, BadIIS backdoors, and the EfsPotato privilege escalation tool.
Why it matters
The concrete takeaway for builders is that this group gains initial access exclusively through publicly disclosed vulnerabilities—meaning unpatched servers are the attack surface, not zero-days. If you run IIS or Linux web servers, patching known CVEs and restricting certutil execution are the specific actions this report implies. The AI integration is notable but does not require a new defensive tool; it accelerates existing offensive workflows against known flaws.
Discussion angle
How AI-assisted offensive tooling like PentestGPT and DeepAudit lowers the effort to operationalize known CVEs at scale—and whether that changes the calculus for how fast teams must patch versus how thoroughly they must patch.