AI Weekly Malaysia

Cisco Talos disclosed a Chinese-speaking cybercrime group dubbed UAT-10147 that integrates AI tools (PentestGPT, DeepAudit) across the attack lifecycle—reconnaissance, exploit refinement, payload generation, validation, and persistence—targeting Windows and Linux web servers globally across education, media, tech, and gaming sectors. The group compiled a target list of ~170,000 URLs split into 17 files of ~10,000 each, exploiting publicly known vulnerabilities for RCE and deploying web shells, BadIIS backdoors, and the EfsPotato privilege escalation tool.

Why: The concrete takeaway for builders is that this group gains initial access exclusively through publicly disclosed vulnerabilities—meaning unpatched servers are the attack surface, not zero-days. If you run IIS or Linux web servers, patching known CVEs and restricting certutil execution are the specific actions this report implies. The AI integration is notable but does not require a new defensive tool; it accelerates existing offensive workflows against known flaws.