UAT-10147: Cybercrime Group Uses Agentic AI to Scale Server Attacks, Deploys SPECTRE Backdoor With Linux Rootkit and Vulnerable-Driver EDR Bypass

Overview

On August 20, 2026, Cisco Talos published a two-part report on UAT-10147 — a financially motivated, Chinese-speaking cybercrime group targeting Windows and Linux web servers globally. Victims span multiple sectors: government, education, media, technology, and gaming.

What makes UAT-10147 notable isn't a single technique, but how the group integrates agentic AI throughout its entire attack lifecycle. Talos assesses with moderate-to-high confidence that this actor represents an emerging class of financially motivated intrusion operators using agentic AI systems to operationalize offensive tradecraft at scale. Unlike simple generative-AI scripting assistance, the group demonstrates: iterative exploit refinement, adaptive troubleshooting, post-exploitation automation, exploit validation workflows, and operational documentation generation — indicating a shift from "AI-assisted scripting" toward "semi-autonomous offensive orchestration."

On the tooling side, UAT-10147 deploys a new cross-platform backdoor called SPECTRE — supporting up to 45 commands on Windows, integrating BYOVD (Bring Your Own Vulnerable Driver) techniques to neutralize EDR at the kernel level, and a Linux rootkit that hides itself using ftrace. Notably, Talos found evidence suggesting the rootkit itself may have been developed with AI assistance.

Important note for a Vietnamese audience: UAT-10147 does not merely happen to have Vietnamese victims. The group operates an SEO-fraud module specifically configured to target Vietnamese internet users (details below). Vietnam is also among the countries where compromised servers have been directly confirmed.

About the Threat Actor

Attribute	Detail
Designation	UAT-10147 (Cisco Talos)
Motivation	Financial — SEO fraud (search-result poisoning) and data theft
Possible linkage	"x神" (xshen) — referenced in a prior Talos report on the BadIIS MaaS ecosystem `[medium confidence]`
Operational maturity	High — combines custom malware, open-source offensive tooling, BYOVD, a Linux kernel rootkit, and sophisticated in-memory web shell deployment
Most distinctive trait	Integrates agentic AI into every phase: exploitation, reconnaissance, payload generation, validation, persistence
Target platforms	Windows (IIS) and Linux web servers

The Thread to "x神" (xshen)

Several campaign components carry links to "x神" — a figure previously referenced in Talos's earlier research on the BadIIS MaaS (Malware-as-a-Service) ecosystem. Evidence includes PDB paths directly referencing "x神" (e.g., a desktop folder named "x神订制全站劫持按浏览器语言跳转," roughly translating to "x神 custom full-site hijack, redirect by browser language"), and another PDB string referencing "x神的自安装服务" ("x神's self-installing service"). The letter "X" also recurs elsewhere: the SEO engine configuration includes a variable named "X-seo," while the web shell uses an "X-ID" HTTP header for covert authentication.

Victimology

Two distinct datasets need to be kept separate:

1. Actually compromised servers (directly observed)

Located in Brazil, Bolivia, China, Canada, and Vietnam, belonging to organizations in government, universities, media, technology, and gaming.

2. Overall target list (from the C2 open directory)

A text file containing roughly 170,000 URLs — the actor apparently realized that scanning the entire list at once was inefficient, so they split it into 17 files, each with about 10,000 URLs. Notably, the group uses the letter "w" as shorthand for the Chinese character "萬" (meaning 10,000) — a small detail that reinforces the language/cultural profile of the actor.

Based on IP addresses resolved from these 170,000 URLs, the top 5 target countries were: the United States, India, the UK, Germany, and the Netherlands.

→ The gap between "confirmed victims" and the "overall target list" suggests UAT-10147's planning scope is far larger than what has been successfully exploited as of discovery.

The OPSEC Failure That Led to Discovery

Talos discovered this activity after observing a compromised machine communicating with a download server hosted at 139.180.197[.]150. Reviewing this IP address revealed an open directory — exposing most of the group's tools, scripts, and frameworks.

Technical Analysis

1. Windows Infection Chain

After achieving RCE (remote code execution) on a website or vulnerable server, the actor runs an automated script to install and deploy malware — for SEO fraud or data theft.

The main script (commonly named back.txt/back.bat) is a multi-stage malware deployment script:

Uses certutil to download the privilege escalation tool EfsPotato (renamed to prcc1.rar to evade extension-based filtering), a secondary batch script (bai.bat), and Quasar RAT (disguised as svchosts.exe) — all from the remote server adminapi.tippusoni[.]in.
Uses EfsPotato to gain elevated system privileges, modifies the Windows Registry, and uses PowerShell to add directories to the Windows Defender exclusion list — effectively hiding the malware from AV scans.
Deletes the initial staging files to cover its tracks and hinder forensic analysis.

In similar campaigns, Talos also observed the group deploying Gh0stCringe and SPECTRE.

The secondary script (bai.bat/bai.txt) silently executes the backdoor and establishes persistence by creating a scheduled task disguised as "Google Chrome Start," running the malware with the highest privileges every time a user logs on.

BadIIS deployment follows this sequence:

Use a privilege escalation tool to add standard IIS directories (System32\inetsrv, SysWOW64\inetsrv) to Defender's exclusion list via PowerShell and Registry modifications.
Use certutil to download dll.zip (compiled BadIIS) and a third script user.bat from adminapi.tippusoni[.]in.
Conduct local reconnaissance via appcmd list site /config /xml to enumerate site configurations — likely to identify injection targets.
Run user.bat with elevated privileges to create a rogue local admin account, adding it to both the Administrators and Remote Desktop Users groups — guaranteeing persistent, highly privileged RDP access.

2. Linux Infection Chain

The attack begins with an RCE payload sent to a vulnerable server to gain an initial foothold. Following successful exploitation, a web shell is deployed, providing persistent, interactive command execution. From there, the actor escalates to root using a broad arsenal of six known LPE (Local Privilege Escalation) CVEs:

CVE	Description
CVE-2022-0995	Flaw in the Linux kernel's `watch_queue` event notification mechanism, enabling out-of-bounds writes
CVE-2021-3156 ("Baron Samedit")	Heap-based buffer overflow in `sudo` — allows any local user to gain root without authentication, even those not in sudoers
CVE-2015-5287	Improper symlink handling in ABRT's `sosreport` functionality
CVE-2015-3246	Flaw in libuser's `roothelper` component, allowing corruption of `/etc/passwd`
CVE-2010-3904	Flaw in the Linux kernel's RDS (Reliable Datagram Sockets) `rds_page_copy_user` function
CVE-2022-0847 ("Dirty Pipe")	High-severity flaw in pipe buffer handling, allowing overwrites of read-only files

Once root access is achieved, the actor deploys multiple implants: Noodle RAT, SPECTRE, and Meterpreter — establishing outbound connections to remote C2 infrastructure.

3. Exploiting Known One-Day Vulnerabilities (via Metasploit)

The actor relies heavily on publicly disclosed vulnerabilities to achieve RCE on both Windows and Linux, using the Metasploit Framework to build targeted exploits and deploy Meterpreter:

CVE-2022-27925 (Zimbra Collaboration Suite) — unauthenticated RCE.
CVE-2021-23758 (AjaxPro) — deserialization RCE.
CVE-2021-29441 & CVE-2021-29442 (Alibaba Nacos) — arbitrary code execution via the ScriptEngineFactory SPI, invoking Runtime.exec() to spawn an OS shell (adaptively /bin/bash on Linux, cmd.exe on Windows). The payload then uses curl to exfiltrate id/hostname (Linux) or %USERNAME%/%COMPUTERNAME% (Windows) directly to a Nacos configuration server controlled by the attacker. By routing exfiltrated data through a legitimate cloud-based configuration management service, the attackers effectively blend their traffic with normal administrative operations — this infrastructure acts as an asynchronous exfiltration sink, letting the actor verify successful exploitation across victims without maintaining a persistent reverse shell or direct inbound connections, reducing detection risk.
CVE-2019-18935 (Telerik UI for ASP.NET AJAX) — a well-known JSON deserialization vulnerability. The actor actively probes environments to confirm the Telerik file upload handler and fingerprint the software version, then deploys a customized weaponized PoC to achieve arbitrary file upload and RCE. Reverse shell DLLs are dropped with a distinct, randomized naming convention: [10 digits].[7 digits].dll.

4. AI-Driven Offensive Tool Assistance

This is the defining feature of the UAT-10147 campaign.

DeepAudit — an AI-driven source-code vulnerability scanning framework. Talos did not directly observe the actor exploiting vulnerabilities discovered by this tool in victim environments, but the framework was installed on the actor's own management server. Talos assesses with high confidence that this framework is intended to identify vulnerabilities in target website source code or third-party libraries; it's also plausible the tool is used defensively — proactively auditing the actor's own infrastructure and tooling to avoid exposure or compromise by other actors or security researchers.

PentestGPT — an open-source autonomous pentesting framework, installed on the actor's C2 server to dynamically scan web servers and execute relevant PoC exploits. In one case, the actor successfully exploited a website and gathered information about the victim machine using Linux commands — fully autonomously.

An AI-generated ASP.NET ViewState deserialization RCE guide — the most notable artifact recovered, a highly detailed 9-section document:

Prerequisites: ValidationKey, DecryptionKey, corresponding algorithms (SHA1/AES/3DES), the target's __VIEWSTATEGENERATOR value, and destination URL — typically obtained via the open-source tool badsecrets (a database of publicly known or leaked ASP.NET MachineKey configurations).
MachineKey validation: submits a deliberately malformed ViewState payload to distinguish between two distinct HTTP 500 errors — MAC Validation Failure (wrong key) versus InvalidCastException (correct key, successful deserialization) — allowing silent confirmation of key validity without triggering meaningful command execution.
Payload generation: uses ysoserial.exe, preferring the TypeConfuseDelegate gadget chain (leverages Process.Start(), still functional on .NET 4.8). Notably, the guide corrects a common misconception: contrary to several public articles, .NET 4.8 does not patch this gadget chain.
Payload delivery: a Python automation script invokes ysoserial.exe and POSTs the payload to the __VIEWSTATE parameter, syncing the __VIEWSTATEGENERATOR value. A notable defensive blind spot: an HTTP 500 with InvalidCastException is the success indicator, not a failure — network monitoring tools alerting on 5xx responses may generate excessive noise while the actual exploit succeeds silently in the error stream.
RCE confirmation via OOB callback: time-based blind testing (e.g., ping -n 10) is entirely ineffective because Process.Start() is asynchronous and returns immediately. The actor pivots to out-of-band HTTP callbacks using certutil, PowerShell + curl, and DNS nslookup.
Post-exploitation reconnaissance: executed entirely via encoded PowerShell commands (evading AMSI and logging) — collecting system information, privilege tokens, web directory listings, IIS site configurations, network interface data, and running processes, all exfiltrated via HTTP POST to a remote webhook.
Interactive shell establishment: three escalating methods — the preferred path deploys SPECTRE directly via certutil; fallbacks include writing an ASHX web shell to the IIS webroot, or a PowerShell TCP reverse shell.
Privilege escalation path: from IIS AppPool identity to SYSTEM, using SeImpersonatePrivilege (a token privilege routinely granted to IIS worker processes) as the vector, compatible with the "Potato" family of tools, or via SPECTRE's built-in escalation capability.
Operational case record: the most significant finding — a detailed log of an actual active intrusion, including target hostnames, backend/frontend IP addresses, the exploited page path, .NET runtime version, and the MachineKey values used. Notably, a MachineKey is scoped at the IIS site level, meaning keys extracted from one virtual host cannot be applied to co-hosted sites.

Four AI-generated Python scripts were also recovered from the actor's infrastructure:

check_paths.py — a post-exploitation diagnostic script running 5 sequential OOB callback tests to a webhook.site endpoint: confirming baseline write capability, exfiltrating the webroot's ACL (via icacls), attempting direct file writes and capturing exact exceptions on failure, querying IIS physical paths via appcmd list vdir, and probing multiple candidate subdirectories.
deploy_implant.py — uses the same ViewState deserialization primitive to download and launch the SPECTRE implant; after a 6-second sleep, runs a PowerShell probe (Test-Path, Get-Item.Length) to verify deployment, reporting results via webhook. Includes a fallback using New-Object Net.WebClient if certutil fails.
deploy_shell.py — deploys a durable ASHX web shell (sss.ashx) in two steps: writing a temporary handler (up.ashx, an 8-line C# handler, Base64-encoded + PowerShell [IO.File]::WriteAllBytes), then using that handler as an HTTP relay to upload the final web shell (preferring a hardcoded local path on the attacker's machine, with a fallback to a secondary staging server at 139.180.197[.]150:54321). Analysis revealed the username "dajiba" on the attacker's machine — the pinyin romanization of a vulgar Chinese term.
exfil.py — blends exfiltration traffic with legitimate SaaS traffic over HTTPS to webhook.site, in three stages: webroot enumeration, IIS site inventory (appcmd.exe list site), and privilege assessment (whoami /priv) to determine viability for Potato-family privilege escalation.

A findings log documents a confirmed RCE via ASP.NET ViewState deserialization on a real IIS target — more than 12 HTTP callbacks confirming four distinct ysoserial gadget chains functioning on .NET 4.8.4797.0, along with reconnaissance data: the webroot contained 13 site directories, and SeImpersonatePrivilege was enabled (opening a viable path for Potato-family escalation).

5. SPECTRE — A New Cross-Platform Backdoor

SPECTRE is a backdoor written in C, supporting both Windows and Linux, named by Talos based on a debug log recovered from one sample. The first observed use of this implant dates to April 2026.

Windows Version

Not the stock Havoc framework — SPECTRE features custom post-exploitation and defense-evasion capabilities compiled directly into the binary, with a dual-layer obfuscation strategy:

API resolution entirely at runtime via PEB hash walking (a DJB2 variant algorithm).
String encryption using a per-string xorshift32 pseudorandom number generator (PRNG) — sensitive literals are encrypted at compile time with unique 32-bit seeds, decrypted to Thread Local Storage immediately before use, and never stored in plaintext within the .text/.rdata sections.

SPECTRE also features a weighted anti-analysis scoring routine, evaluating: process name blocklists, RAM capacity, CPU core count, disk space, sleep-acceleration detection, and common sandbox host/usernames. If the cumulative score reaches 50 or higher, the process self-terminates.

C2: communicates via HTTP POST to the /api/v1/register and /api/v1/output endpoints; a fallback C2 domain is hardcoded (recoverable via string decryption). Notably, one variant reads its C2 configuration from an NTFS Alternate Data Stream (ADS) at C:\Windows\System32\drivers\etc\hosts:cache — allowing the actor to update C2 configuration simply by modifying the ADS, evading firewall blocklists without recompiling the binary.

Command set: Talos identified 45 commands — 24 plaintext, 21 encrypted with the xorshift PRNG (decrypted at each dispatch). The encrypted commands concentrate on three sensitive capability groups:

Capability Group	Representative Commands	Description
Process Injection	`inject`, `s-nject`, `earlybird`, `hollow`	Three methods: process hollowing (default `svchost.exe`); APC EarlyBird injection (delivering shellcode before the target thread executes its first instruction); automated on-startup self-hollowing targeting `RuntimeBroker.exe`, executed directly from `main()` to conceal the implant
Privilege Escalation & Credential Theft	`getsystem`, `steal_token`, `make_token`, `hashdump`, `vaultdump`, `chromedump`	Named pipe impersonation (`\\.\pipe\spectre_<tid>` + `ImpersonateNamedPipeClient`) to obtain a SYSTEM token; saves three registry hives (SAM, SYSTEM, SECURITY) to `%TEMP%` via `RegSaveKeyA` for offline NT hash extraction via `secretsdump.py`; Vaultdump enumerates Windows Credential Manager via `cmdkey.exe /list` (no LSASS access needed); Chromedump copies Chrome/Edge Login Data + Local State for offline DPAPI decryption via SharpChrome
BYOVD EDR Killer	`byovd_load`, `byovd_unload`, `edr_kill`, `callbacks`, `byovd_verify`	See details below

The 24 plaintext commands cover basic operations: shell/sh, pwd/cd, ls, cat, mkdir, rm, cp, mv, download, upload, ps, kill, env, sleep, sysinfo, screenshot, whoami, netinfo, timestomp, rev2self, getprivs, selfdel, reg, exit.

BYOVD Mechanism (Bring Your Own Vulnerable Driver): SPECTRE downloads one of two well-known vulnerable drivers from the C2 — MSI's RTCore64.sys (CVE-2019-16098) or Dell's DBUtil_2_3.sys (CVE-2021-21551). The driver is decoded, written to %TEMP%, installed as a transient kernel service via the Service Control Manager, then an IOCTL handle is opened to the device. Leveraging the arbitrary kernel read/write primitives exposed by these drivers, SPECTRE uses NtQuerySystemInformation to locate ntoskrnl.exe in kernel address space, then references a hardcoded offset table covering 13 Windows versions to calculate the exact kernel virtual addresses for PspCreateProcessNotifyRoutine, PspCreateThreadNotifyRoutine, and PspLoadImageNotifyRoutine. Through targeted kernel writes, SPECTRE safely unlinks each registered EDR callback from its doubly-linked list. As a result, kernel-callback-dependent security products such as CrowdStrike Falcon, SentinelOne, Microsoft Defender, and other well-known EDR vendors are rendered completely blind to new process creation, thread creation, and image load events for the rest of the session — fully neutralizing EDR visibility on the target machine.

Linux Version

A statically-linked ELF x86-64 binary. Upon execution, SPECTRE immediately invokes an eight-factor anti-sandbox scoring engine before establishing a C2 connection; if the cumulative score reaches the threshold of 50, the binary exits silently, generating no observable indicators. Following successful validation, SPECTRE beacons to a hardcoded C2 domain with a JSON payload — identical in structure to the Windows version.

Rather than 45 commands, the Linux version has only 29 commands, none obfuscated or encrypted: basic file system operations (ls, cat, mkdir, rm, cp, mv, download, upload), system/process reconnaissance (ps, sysinfo, whoami, id, netinfo), agent management (sleep, kill, selfdel, exit), unrestricted shell execution (shell//bin/sh), and notably timestomp — an anti-forensics mechanism using utimensat() and operator-provided timestamps to alter a file's modification, access, and change times.

Its most critical capability: a dedicated command set (rootkit_load, rootkit_hide, rootkit_root, rootkit_hide_mod, rootkit_status, rootkit_persist, rootkit_unload) controlling an integrated kernel-level rootkit called "Specter," deployed as a loadable kernel module disguised as acpi_pad.ko (mimicking the legitimate ACPI processor power management module). For persistence, the rootkit uses a fraudulent systemd unit named hardware-monitor.service, described as "Hardware Performance Monitor," and critically — configured with Before=sysinit.target, ensuring the rootkit executes before any security tooling initializes, on every system boot.

User-level communication with the loaded kernel module occurs via a signal-based IPC mechanism: issuing kill() syscalls targeting a magic PID value of 0x7A69 (decimal 31337 — the well-known "elite"/leet hacker-culture number) with specific real-time signal numbers encoding the desired operation:

Signal 62: triggers process hiding — removes the target task_struct from the kernel's PID list, rendering /proc/<pid> invisible.
Signal 36: hides the module itself from lsmod — unlinks THIS_MODULE from the kernel module linked list.
Signal 37: escalates the implant process to UID 0 — directly overwrites the process credential structure.
Signal 35: serves as a module-load acknowledgment handshake.

6. Specter — The Linux Kernel Rootkit

The SPECTRE backdoor loads a Linux kernel rootkit named Specter to prevent detection by security products. Rather than patching the syscall table (an older, more detectable technique), the rootkit uses the Linux kernel's native "ftrace" instrumentation framework — a legitimate kernel debugging interface — with the flag FTRACE_OPS_FL_IPMODIFY to redirect execution at the function entry point of six syscall handlers:

hooked_tcp6_seq_show
hooked_tcp4_seq_show
hooked_tkill
hooked_tgkill
hooked_kill
hooked_getdents64

Because ftrace is a legitimate kernel debugging interface, this approach produces minimal noise in kernel integrity checks.

7. Evidence of AI-Assisted Development in the Rootkit Itself

This is arguably the most notable finding of the entire report. Talos assesses with medium confidence that UAT-10147 combined AI-assisted development and human expertise to create the Specter rootkit, based on three pieces of evidence:

Documentation structure: the feature list at the top of the source code reads like a "product spec," not a developer's notes — resembling a direct response to a prompt like "Write a rootkit with the following features." This is the AI narrating what it is about to produce.
Rigid, uniform decorative separators: identical width and formatting applied consistently across 10+ logical sections — a machine-like uniformity that is a classic hallmark of AI-generated output. The text also carries a pedagogical tone: a real developer writing a rootkit wouldn't need to explain basic concepts to themselves, such as taint flags or how to run cat /proc/sys/kernel/tainted — content clearly structured as an educational explanation for a reader, rather than authentic internal developer notes.
The inclusion of three distinct methods for the same purpose, explicitly labeled "Method 1," "Method 2," "Method 3" — a common artifact of AI generation. When prompted to be thorough, AI models tend to output every known approach; by contrast, a human developer targeting a specific kernel would simply select and implement the single most effective method. This exhaustive, multi-method presentation is a classic example of an AI's "completeness reflex."

Additional evidence lies in the self-compiled "Potato" family privilege-escalation tools (EfsPotato, RustPotato): PDB strings and local paths reveal the actor building these tools in a directory literally named "AI" (C:\Users\iis\Desktop\AI\EfsPotatoCpp\..., C:\Users\Intel\Desktop\AI\EfsPotatoCPP\...) — a small but strong detail reinforcing the hypothesis that the actor is leveraging AI to assist in developing its custom tooling.

8. SEO Fraud Tooling — Deliberately Targeting Vietnamese Internet Users

UAT-10147 deploys two types of SEO fraud tools with fundamentally different persistence mechanisms:

a) BadIIS (Malware-as-a-Service) — the core variant confirmed to be the exact same sample documented in Talos's earlier research on the BadIIS MaaS ecosystem (characterized by the demo.pdb string), operating as a Malware-as-a-Service used by multiple Chinese-speaking cybercrime groups — not exclusively UAT-10147.

b) ASHX SEO Engine — a new C# ASHX web handler that silently takes over an IIS application's request pipeline via reflection. Functionally similar to standard BadIIS: serves fabricated content to search crawlers to poison rankings, while delivering malicious JavaScript to targeted users. The class is explicitly named SeoEngineHandler.

The key finding: the handler's internal configuration reveals it was specifically designed to target Vietnamese internet users:

Configured C2 domains use the vn.xyz suffix.
The malware explicitly targets the crawler for "Cốc Cốc" (configured as coccoc) — a prominent Vietnamese web browser and search engine.

This is not an incidental or secondary detail — it is direct evidence that Vietnamese internet users fall within the deliberate targeting scope of this SEO-fraud tool, rather than being incidental victims in a global scanning campaign.

9. The "Potato" Privilege Escalation Family

The actor uses multiple "Potato" family tools to achieve system-level privileges. Some, like GodPotato and JuicyPotato, were downloaded as precompiled binaries; others, like EfsPotato and RustPotato, were self-compiled from source. As noted in Section 7, PDB strings and local file paths exposed in these self-compiled payloads reveal details of the actor's development environment — including a build directory named "AI."

10. Other Backdoors for Persistence

Web shell: a sophisticated two-layer architecture. The outer handler functions as a self-bootstrapping loader that leverages in-memory dynamic compilation to execute its payload. Upon receiving the first HTTP request, the handler reverses an obfuscated string, decodes it via Base64, and dynamically compiles the resulting code in memory using CodeDomProvider. To optimize execution and ensure thread safety, it caches the compiled assembly in a static field (_a) using double-checked locking, ensuring the payload is compiled only once per IIS worker process lifetime. The embedded handler functions as a versatile web shell, relying on a numeric parameter to dispatch operational modes, with strict multi-tiered authentication: it inspects the X-ID HTTP header for a specific token; if absent, it falls back to a v parameter; if neither matches the exact value "x9", the handler immediately halts and returns a deceptive "404 Not Found" error — allowing the covert authentication process to blend seamlessly into routine HTTP traffic.

Command	Function
0 (default)	Get system information (MachineName / Username / OSVersion / CurrentPath)
1	Execute system command (`b` = binary to run, default `cmd.exe`; `g` = arguments)
2	Read file
3	Write file
4	Direct file download
5	Directory listing

Meterpreter: reverse Meterpreter shells deployed to maintain persistent access to compromised Linux hosts — functioning as a first-stage shellcode dropper that, upon a successful connection, retrieves a second-stage payload to establish persistence and full C2.

Noodle RAT: the Type 0x03A2 ELF variant (previously documented by Trend Micro) — deployed as a final-stage backdoor for persistent Linux access.

Quasar RAT: a notable characteristic is its configured Campaign ID, which contains a derogatory Chinese-language term targeting elderly Vietnamese people. While not technically significant, this artifact offers insight into the actor's sentiment or specific geographic targeting — further reinforcing the Vietnam-targeting evidence noted in Section 8.

Gh0stCringe: embedded as shellcode within a custom Go-based loader to evade detection.

Risk Summary

Risk Dimension	Level	Rationale
EDR bypass capability	Critical	BYOVD fully neutralizes kernel callbacks for CrowdStrike, SentinelOne, Defender, and other EDR products
Persistence	Very High	Linux kernel rootkit runs before any security tooling initializes at boot; survives reboots
Stealth	Very High	Dual obfuscation (PEB hash walking + xorshift32), anti-sandbox scoring on both platforms, low-noise ftrace hooking
AI-driven scale	Very High	AI assists every phase: exploitation, reconnaissance, payload generation, validation, operational documentation
Blast radius	High	170,000 URLs on the target list; confirmed victims span five countries and multiple sectors
Credential theft	High	Dumps SAM/SYSTEM/SECURITY hives, Credential Manager, Chrome/Edge login data
Vietnam-targeting severity	Concerning	SEO fraud module specifically configured for Vietnamese users (Cốc Cốc, `vn.xyz` domain); Vietnam is among confirmed victims

IOCs & Artifacts

Network Indicators

Indicator	Type	Role
`139.180.197[.]150`	IP	Primary open directory / download server; also used port `54321` as a secondary staging server
`adminapi.tippusoni[.]in`	Domain	Hosts EfsPotato, Quasar RAT, BadIIS, and deployment scripts
Domains with `vn.xyz` suffix	Domain pattern	C2 for the ASHX SEO Engine, targeting Vietnamese users

Host-based Indicators

Scheduled Task: Google Chrome Start (runs the backdoor at every logon with the highest privileges).
Batch scripts: back.txt/back.bat, bai.bat/bai.txt, user.txt/user.bat.
Evasive renaming: EfsPotato renamed to prcc1.rar; Quasar RAT disguised as svchosts.exe.
Reverse shell DLL (from CVE-2019-18935): naming convention [10 digits].[7 digits].dll.
Masqueraded kernel module: acpi_pad.ko.
Fake systemd unit: hardware-monitor.service (described as "Hardware Performance Monitor," Before=sysinit.target).
Magic PID (rootkit IPC): 0x7A69 (31337).
Web shell authentication: X-ID header or v parameter = "x9".
ASHX web shell: sss.ashx, temporary handler up.ashx.
SEO engine class: SeoEngineHandler, targeted crawler coccoc.
Abused Windows Defender exclusion paths: C:\Windows\System32\inetsrv, C:\Windows\SysWOW64\inetsrv.
NTFS ADS used for C2 config storage: C:\Windows\System32\drivers\etc\hosts:cache.

PDB Paths (Attribution Evidence)

C:\Users\Administrator\Desktop\2025-11-21 (x神订制全站劫持按浏览器语言跳转)\dll\Release\demo.pdb
C:\Users\Administrator\Desktop\2025-11-21 (x神订制全站劫持按浏览器语言跳转)\dll\x64\Release\demo.pdb
C:\Users\Administrator\Desktop\x神的自安装服务\svchost\x64\Release\service.pdb
C:\Users\iis\Desktop\AI\EfsPotatoCpp\x64\Release\EfsPotato.pdb
C:\Users\Intel\Desktop\AI\EfsPotatoCPP\x64\Debug\EfsPotato.pdb

Weaponized CVEs (Summary)

CVE	Product/Component	Type
CVE-2022-27925	Zimbra Collaboration Suite	Unauthenticated RCE
CVE-2021-23758	AjaxPro	Deserialization RCE
CVE-2021-29441 / CVE-2021-29442	Alibaba Nacos	Arbitrary code execution
CVE-2019-18935	Telerik UI for ASP.NET AJAX	JSON deserialization RCE
CVE-2022-0995	Linux kernel (watch_queue)	LPE
CVE-2021-3156	sudo ("Baron Samedit")	LPE
CVE-2015-5287	ABRT sosreport	LPE
CVE-2015-3246	libuser roothelper	LPE
CVE-2010-3904	Linux kernel RDS	LPE
CVE-2022-0847	Linux kernel ("Dirty Pipe")	LPE
CVE-2019-16098	MSI RTCore64.sys	BYOVD
CVE-2021-21551	Dell DBUtil_2_3.sys	BYOVD

Complete IOC list (hashes, additional domains): Cisco Talos published detailed IOC repositories on GitHub — see References below.

Coverage (Detection Signatures Published by Talos)

ClamAV: Py.Loader.Tool-10060293-1/2, multiple Win.Malware.Generic variants, Win.Loader.Downloader-10060287-1, Win.Malware.BadPotato-10060230-0, Unix.Rootkit.Malware-10060258-0, Unix.Rootkit.Spectre-10060260-0, Unix.Backdoor.Msfvenom-10012672-0, Win.Malware.BadIIS-10059985-0, Asp.Rootkit.Badiis-10060290-1, and additional signatures (see original source for the complete list).

Snort: SIDs 1:66688, 1:66689, 1:66690, 1:66696, 1:66697, 1:301548 (Snort2/Snort3).

MITRE ATT&CK Mapping

Tactic	Technique ID	Technique Name	Description in Campaign
Initial Access	T1190	Exploit Public-Facing Application	The entire initial RCE chain across Zimbra, AjaxPro, Nacos, Telerik CVEs, and custom exploits
Execution	T1059.001 / T1059.003 / T1059.004	Command and Scripting Interpreter (PowerShell / Windows Batch / Unix Shell)	The `back.bat`, `bai.bat`, `user.bat` scripts; SPECTRE's `shell`/`sh` command
Persistence	T1053.005	Scheduled Task/Job	"Google Chrome Start" task
Persistence	T1543.002/.003	Create or Modify System Process (Systemd Service / Windows Service)	Fake `hardware-monitor.service`; BadIIS service installer
Persistence	T1505.003	Server Software Component: Web Shell	Two-layer web shell; ASHX web shell `sss.ashx`
Persistence	T1136	Create Account	Rogue local admin account creation, added to RDP group
Privilege Escalation	T1068	Exploitation for Privilege Escalation	Six LPE CVEs on Linux; EfsPotato/GodPotato/JuicyPotato/RustPotato on Windows
Privilege Escalation	T1134	Access Token Manipulation	SPECTRE's named pipe impersonation, `steal_token`, `make_token`
Privilege Escalation	T1055 / T1055.012	Process Injection / Process Hollowing	`inject`, `hollow`, `earlybird` (APC EarlyBird) on SPECTRE Windows
Defense Evasion	T1562.001	Impair Defenses: Disable or Modify Tools	Adding Windows Defender exclusions for IIS directories and malware
Defense Evasion	T1014	Rootkit	The "Specter" Linux rootkit (ftrace hooking)
Defense Evasion	T1622 / T1497	Debugger/Sandbox Evasion	Weighted anti-sandbox scoring on both Windows and Linux
Defense Evasion	T1027	Obfuscated Files or Information	xorshift32 string encryption; PEB hash walking API resolution
Defense Evasion	T1070.004 / T1070.006	Indicator Removal (File Deletion / Timestomp)	Deleting staging payloads; `timestomp` command
Defense Evasion	T1564.001	Hide Artifacts: Hidden Files and Directories	`rootkit_hide` (process hiding from `/proc`), `rootkit_hide_mod` (hiding from `lsmod`)
Defense Evasion	T1036	Masquerading	`acpi_pad.ko`, "Google Chrome Start," the web shell's fake 404
Credential Access	T1003.002	OS Credential Dumping: SAM	Dumping SAM/SYSTEM/SECURITY hives via `RegSaveKeyA`
Credential Access	T1555.003 / T1555.004	Credentials from Web Browsers / Windows Credential Manager	`chromedump`, `vaultdump`
Credential Access	T1552	Unsecured Credentials	Exploiting leaked/public MachineKeys via `badsecrets`
Discovery	T1082 / T1057 / T1083 / T1016	System/Process/File/Network Discovery	`sysinfo`, `ps`, `ls`, `netinfo` commands; recon via `appcmd`, `whoami /priv`
Collection	T1113 / T1056.001	Screen Capture / Keylogging	`screenshot`, `keylog_start/stop/dump`
Command and Control	T1071.001	Application Layer Protocol: Web Protocols	HTTPS to `/api/v1/register`, `/api/v1/output`
Command and Control	T1102	Web Service	The Nacos config server and `webhook.site` as exfiltration sinks
Exfiltration	T1041 / T1567	Exfiltration Over C2 Channel / Web Service	Reconnaissance data exfiltrated via webhook, Nacos

Assessment

UAT-10147 is one of the clearest and most systematic examples to date of a purely criminal threat actor (not a nation-state APT) leveraging agentic AI throughout the entire attack lifecycle — not merely to write supporting scripts, but to iteratively refine exploits, troubleshoot adaptively, automate post-exploitation, validate exploits, and generate complete operational documentation. The fact that AI produced a 9-section exploitation guide — including correcting a common technical misconception found on the public internet, logging an actual operational case, and documenting a "defensive blind spot" (HTTP 500 = success) — suggests the actor is using AI as a diligent, meticulous junior teammate, not merely a command-typing assistant.

More concerning still, evidence of AI-assisted development appears directly within the Linux kernel rootkit itself — documentation structured like a "product spec," a pedagogical tone explaining basic concepts, and a "completeness reflex" listing three methods for the same goal. This signals that AI is no longer confined to assisting with high-level attack scripting, but is creeping into kernel-level malware development — a domain that previously required deep expertise and was rarely accessible to run-of-the-mill cybercriminals.

UAT-10147's attack chain requires no zero-days whatsoever. It relies entirely on publicly known vulnerabilities (one-days), misconfigurations, and leaked secrets (MachineKeys). This reaffirms a fundamental defensive principle: timely patch management and secret hygiene remain the most effective defenses, regardless of how sophisticated an adversary's AI assistance becomes. At the same time, the fact that an ordinary cybercrime group now has access to kernel-level BYOVD EDR neutralization and an ftrace-based Linux rootkit — techniques once nearly exclusive to nation-state APT groups — shows that the capability gap between cybercrime and APT is rapidly narrowing, in no small part because AI lowers the skill barrier required.

For organizations in Vietnam, this is a specific, direct warning — not a generic risk. UAT-10147 does not merely happen to have Vietnamese victims: the group operates an SEO-fraud module specifically configured to target Cốc Cốc and uses C2 domains with a vn.xyz suffix — evidence of a deliberate campaign targeting Vietnamese internet users, combined with the fact that Vietnam already appears among the five countries with confirmed compromised servers. Vietnamese organizations running internet-facing IIS or Linux servers — particularly in government, education, media, technology, and gaming — should treat this as an active, deliberately targeted threat, not a theoretical risk.

Recommendations

Patching & Attack Surface Management (Highest Priority)

Patch the CVEs listed above immediately — especially Zimbra (CVE-2022-27925), Telerik UI (CVE-2019-18935), and Nacos (CVE-2021-29441/29442) if your organization uses these products.
On Linux servers: prioritize patching sudo (CVE-2021-3156) and the kernel (Dirty Pipe, CVE-2022-0847) — the two most dangerous and widespread LPE vulnerabilities in the list.
Protect ASP.NET MachineKeys: never use default or publicly known MachineKey values; audit internal ASP.NET applications with tools like badsecrets to proactively catch leaked keys before an attacker does.

Windows Detection

Monitor for anomalous Windows Defender exclusion list changes, especially paths like System32\inetsrv, SysWOW64\inetsrv, or any directory added via PowerShell/Registry immediately following suspicious execution activity.
Alert on installation of uncommon kernel drivers (especially RTCore64.sys, DBUtil_2_3.sys) — a classic BYOVD indicator; consider deploying the Microsoft Vulnerable Driver Blocklist.
Audit scheduled tasks named "Google Chrome Start" or any task disguised as legitimate software but pointing to an anomalous binary/path.
Inspect NTFS Alternate Data Streams on sensitive system files such as hosts — an unusual ADS may hide C2 configuration.
Monitor new local admin account creation paired with addition to the Remote Desktop Users group.

Linux Detection

Audit loaded kernel modules, especially those with legitimate-sounding names (acpi_pad and variants) but anomalous hashes or origins.
Check new systemd units, especially those configured with Before=sysinit.target— a strong indicator of a persist-before-security-tooling technique.
Monitor kill() syscalls targeting non-existent or anomalous PIDs (such as 31337) — a signature of signal-based rootkit IPC.
Inspect unusual ftrace usage — while a legitimate API, an unrecognized process registering ftrace hooks on sensitive syscalls is a suspicious signal.

General

Treat any persistent backdoor as a starting point for privilege escalation + BYOVD, not just a surface-level malware removal task.
For Vietnamese organizations with public-facing web presence: review access logs for anomalous bot/crawler activity related to coccoc or browser-language-based redirects — a signature of the Vietnam-targeting SEO fraud module.
Deploy EDR capable of detecting BYOVD (monitoring new kernel driver installations, not relying solely on traditional callbacks — since those very callbacks can be neutralized).
Conduct proactive threat hunting using the published IOCs (see References) — especially PDB paths and strings related to "x神."

Command Palette