# UAT-10147: Cybercrime Group Uses Agentic AI to Scale Server Attacks, Deploys SPECTRE Backdoor With Linux Rootkit and Vulnerable-Driver EDR Bypass

## Overview

On August 20, 2026, **Cisco Talos** published a two-part report on **UAT-10147** — a financially motivated, Chinese-speaking cybercrime group targeting Windows and Linux web servers **globally**. Victims span multiple sectors: **government, education, media, technology, and gaming**.

What makes UAT-10147 notable isn't a single technique, but **how the group integrates agentic AI throughout its entire attack lifecycle**. Talos assesses with **moderate-to-high confidence** that this actor represents an emerging class of financially motivated intrusion operators using agentic AI systems to **operationalize offensive tradecraft at scale**. Unlike simple generative-AI scripting assistance, the group demonstrates: **iterative exploit refinement, adaptive troubleshooting, post-exploitation automation, exploit validation workflows, and operational documentation generation** — indicating a shift from "AI-assisted scripting" toward **"semi-autonomous offensive orchestration."**

On the tooling side, UAT-10147 deploys a new cross-platform backdoor called **SPECTRE** — supporting up to 45 commands on Windows, integrating **BYOVD (Bring Your Own Vulnerable Driver)** techniques to neutralize EDR at the kernel level, and a **Linux rootkit** that hides itself using ftrace. Notably, Talos found evidence suggesting **the rootkit itself may have been developed with AI assistance**.

> **Important note for a Vietnamese audience:** UAT-10147 does not merely happen to have Vietnamese victims. The group operates an SEO-fraud module **specifically configured to target Vietnamese internet users** (details below). Vietnam is also among the countries where compromised servers have been directly confirmed.

* * *

## About the Threat Actor

| **Attribute** | **Detail** |
| --- | --- |
| **Designation** | UAT-10147 (Cisco Talos) |
| **Motivation** | Financial — SEO fraud (search-result poisoning) and data theft |
| **Possible linkage** | "x神" (xshen) — referenced in a prior Talos report on the BadIIS MaaS ecosystem `[medium confidence]` |
| **Operational maturity** | High — combines custom malware, open-source offensive tooling, BYOVD, a Linux kernel rootkit, and sophisticated in-memory web shell deployment |
| **Most distinctive trait** | Integrates agentic AI into every phase: exploitation, reconnaissance, payload generation, validation, persistence |
| **Target platforms** | Windows (IIS) and Linux web servers |

### The Thread to "x神" (xshen)

Several campaign components carry links to "x神" — a figure previously referenced in Talos's earlier research on the **BadIIS MaaS** (Malware-as-a-Service) ecosystem. Evidence includes PDB paths directly referencing "x神" (e.g., a desktop folder named "x神订制全站劫持按浏览器语言跳转," roughly translating to "x神 custom full-site hijack, redirect by browser language"), and another PDB string referencing "x神的自安装服务" ("x神's self-installing service"). The letter "X" also recurs elsewhere: the SEO engine configuration includes a variable named "X-seo," while the web shell uses an "X-ID" HTTP header for covert authentication.

* * *

## Victimology

Two **distinct datasets** need to be kept separate:

![](https://cdn.hashnode.com/uploads/covers/669e2578c18c3baa1b4fc070/0ff6e22f-e598-4086-81d8-f3ec9b048fde.png align="center")

### 1\. Actually compromised servers (directly observed)

Located in **Brazil, Bolivia, China, Canada, and Vietnam**, belonging to organizations in **government, universities, media, technology, and gaming**.

### 2\. Overall target list (from the C2 open directory)

![](https://cdn.hashnode.com/uploads/covers/669e2578c18c3baa1b4fc070/7bc0ddd1-3e45-425f-a011-b567ac821e23.png align="center")

A text file containing roughly **170,000 URLs** — the actor apparently realized that scanning the entire list at once was inefficient, so they **split it into 17 files**, each with about 10,000 URLs. Notably, the group uses the letter **"w"** as shorthand for the Chinese character **"萬"** (meaning 10,000) — a small detail that reinforces the language/cultural profile of the actor.

Based on IP addresses resolved from these 170,000 URLs, the **top 5 target countries** were: **the United States, India, the UK, Germany, and the Netherlands**.

→ The gap between "confirmed victims" and the "overall target list" suggests UAT-10147's **planning scope is far larger** than what has been successfully exploited as of discovery.

### The OPSEC Failure That Led to Discovery

Talos discovered this activity after observing a compromised machine communicating with a download server hosted at `139.180.197[.]150`. Reviewing this IP address revealed an **open directory** — exposing most of the group's tools, scripts, and frameworks.

* * *

## Technical Analysis

### 1\. Windows Infection Chain

After achieving RCE (remote code execution) on a website or vulnerable server, the actor runs an automated script to install and deploy malware — for SEO fraud or data theft.

![](https://cdn.hashnode.com/uploads/covers/669e2578c18c3baa1b4fc070/aad4b785-52b5-4ead-a4f8-3b3f9aad51a6.png align="center")

**The main script** (commonly named `back.txt`/`back.bat`) is a multi-stage malware deployment script:

1.  Uses `certutil` to download the privilege escalation tool **EfsPotato** (renamed to `prcc1.rar` to evade extension-based filtering), a secondary batch script (`bai.bat`), and **Quasar RAT** (disguised as `svchosts.exe`) — all from the remote server `adminapi.tippusoni[.]in`.
    
2.  Uses **EfsPotato** to gain elevated system privileges, modifies the Windows Registry, and uses PowerShell to **add directories to the Windows Defender exclusion list** — effectively hiding the malware from AV scans.
    
3.  **Deletes the initial staging files** to cover its tracks and hinder forensic analysis.
    

In similar campaigns, Talos also observed the group deploying **Gh0stCringe** and **SPECTRE**.

**The secondary script** (`bai.bat`/`bai.txt`) silently executes the backdoor and establishes persistence by creating a **scheduled task disguised as "Google Chrome Start,"** running the malware with the highest privileges every time a user logs on.

**BadIIS deployment** follows this sequence:

1.  Use a privilege escalation tool to add standard IIS directories (`System32\inetsrv`, `SysWOW64\inetsrv`) to Defender's exclusion list via PowerShell and Registry modifications.
    
2.  Use `certutil` to download `dll.zip` (compiled BadIIS) and a third script `user.bat` from `adminapi.tippusoni[.]in`.
    
3.  Conduct local reconnaissance via `appcmd list site /config /xml` to enumerate site configurations — likely to identify injection targets.
    
4.  Run `user.bat` with elevated privileges to **create a rogue local admin account**, adding it to both the Administrators and Remote Desktop Users groups — guaranteeing persistent, highly privileged RDP access.
    

### 2\. Linux Infection Chain

The attack begins with an RCE payload sent to a vulnerable server to gain an initial foothold. Following successful exploitation, a **web shell** is deployed, providing persistent, interactive command execution. From there, the actor escalates to **root** using a broad arsenal of six known LPE (Local Privilege Escalation) CVEs:

![](https://cdn.hashnode.com/uploads/covers/669e2578c18c3baa1b4fc070/6f6da4ba-41d4-4c6f-83bf-0e9488c4a4df.png align="center")

| **CVE** | **Description** |
| --- | --- |
| CVE-2022-0995 | Flaw in the Linux kernel's `watch_queue` event notification mechanism, enabling out-of-bounds writes |
| CVE-2021-3156 ("Baron Samedit") | Heap-based buffer overflow in `sudo` — allows any local user to gain root without authentication, even those not in sudoers |
| CVE-2015-5287 | Improper symlink handling in ABRT's `sosreport` functionality |
| CVE-2015-3246 | Flaw in libuser's `roothelper` component, allowing corruption of `/etc/passwd` |
| CVE-2010-3904 | Flaw in the Linux kernel's RDS (Reliable Datagram Sockets) `rds_page_copy_user` function |
| CVE-2022-0847 ("Dirty Pipe") | High-severity flaw in pipe buffer handling, allowing overwrites of read-only files |

Once root access is achieved, the actor deploys multiple implants: **Noodle RAT**, **SPECTRE**, and **Meterpreter** — establishing outbound connections to remote C2 infrastructure.

### 3\. Exploiting Known One-Day Vulnerabilities (via Metasploit)

The actor relies heavily on publicly disclosed vulnerabilities to achieve RCE on both Windows and Linux, using the **Metasploit Framework** to build targeted exploits and deploy Meterpreter:

![](https://cdn.hashnode.com/uploads/covers/669e2578c18c3baa1b4fc070/b77758fd-4f78-4407-9d83-532058b84ba4.png align="center")

*   **CVE-2022-27925** (Zimbra Collaboration Suite) — unauthenticated RCE.
    
*   **CVE-2021-23758** (AjaxPro) — deserialization RCE.
    
*   **CVE-2021-29441 & CVE-2021-29442** (Alibaba Nacos) — arbitrary code execution via the `ScriptEngineFactory` SPI, invoking `Runtime.exec()` to spawn an OS shell (adaptively `/bin/bash` on Linux, `cmd.exe` on Windows). The payload then uses `curl` to exfiltrate `id`/`hostname` (Linux) or `%USERNAME%`/`%COMPUTERNAME%` (Windows) directly to **a Nacos configuration server controlled by the attacker**. By routing exfiltrated data through a legitimate cloud-based configuration management service, the attackers **effectively blend their traffic with normal administrative operations** — this infrastructure acts as an asynchronous exfiltration sink, letting the actor verify successful exploitation across victims **without maintaining a persistent reverse shell or direct inbound connections**, reducing detection risk.
    
*   **CVE-2019-18935** (Telerik UI for ASP.NET AJAX) — a well-known JSON deserialization vulnerability. The actor actively probes environments to confirm the Telerik file upload handler and fingerprint the software version, then deploys a customized weaponized PoC to achieve arbitrary file upload and RCE. Reverse shell DLLs are dropped with a distinct, randomized naming convention: `[10 digits].[7 digits].dll`.
    

![](https://cdn.hashnode.com/uploads/covers/669e2578c18c3baa1b4fc070/c3c2ea8f-5651-46fa-a199-68fa9b8456b5.png align="center")

### 4\. AI-Driven Offensive Tool Assistance

This is the defining feature of the UAT-10147 campaign.

![](https://cdn.hashnode.com/uploads/covers/669e2578c18c3baa1b4fc070/cfeb8d26-4243-422d-afad-d9882566dd30.png align="center")

**DeepAudit** — an AI-driven source-code vulnerability scanning framework. Talos did not directly observe the actor exploiting vulnerabilities discovered by this tool in victim environments, but the framework was installed on the actor's own management server. Talos assesses with high confidence that this framework is intended to **identify vulnerabilities in target website source code or third-party libraries**; it's also plausible the tool is used **defensively** — proactively auditing the actor's own infrastructure and tooling to avoid exposure or compromise by other actors or security researchers.

**PentestGPT** — an open-source autonomous pentesting framework, installed on the actor's C2 server to **dynamically scan web servers and execute relevant PoC exploits**. In one case, the actor successfully exploited a website and gathered information about the victim machine using Linux commands — fully autonomously.

**An AI-generated ASP.NET ViewState deserialization RCE guide** — the most notable artifact recovered, a highly detailed 9-section document:

1.  **Prerequisites:** `ValidationKey`, `DecryptionKey`, corresponding algorithms (SHA1/AES/3DES), the target's `__VIEWSTATEGENERATOR` value, and destination URL — typically obtained via the open-source tool **badsecrets** (a database of publicly known or leaked ASP.NET `MachineKey` configurations).
    
2.  **MachineKey validation:** submits a deliberately malformed ViewState payload to distinguish between two distinct HTTP 500 errors — *MAC Validation Failure* (wrong key) versus *InvalidCastException* (correct key, successful deserialization) — allowing silent confirmation of key validity **without triggering meaningful command execution**.
    
3.  **Payload generation:** uses `ysoserial.exe`, preferring the **TypeConfuseDelegate** gadget chain (leverages `Process.Start()`, still functional on .NET 4.8). Notably, the guide **corrects a common misconception**: contrary to several public articles, .NET 4.8 does **not** patch this gadget chain.
    
4.  **Payload delivery:** a Python automation script invokes `ysoserial.exe` and POSTs the payload to the `__VIEWSTATE` parameter, syncing the `__VIEWSTATEGENERATOR` value. **A notable defensive blind spot:** an HTTP 500 with `InvalidCastException` is the **success indicator**, not a failure — network monitoring tools alerting on 5xx responses may generate excessive noise while the actual exploit succeeds silently in the error stream.
    
5.  **RCE confirmation via OOB callback:** time-based blind testing (e.g., `ping -n 10`) is **entirely ineffective** because `Process.Start()` is asynchronous and returns immediately. The actor pivots to out-of-band HTTP callbacks using `certutil`, PowerShell + `curl`, and DNS `nslookup`.
    
6.  **Post-exploitation reconnaissance:** executed entirely via encoded PowerShell commands (evading AMSI and logging) — collecting system information, privilege tokens, web directory listings, IIS site configurations, network interface data, and running processes, all exfiltrated via HTTP POST to a remote webhook.
    
7.  **Interactive shell establishment:** three escalating methods — the preferred path deploys **SPECTRE** directly via `certutil`; fallbacks include writing an ASHX web shell to the IIS webroot, or a PowerShell TCP reverse shell.
    
8.  **Privilege escalation path:** from IIS AppPool identity to SYSTEM, using `SeImpersonatePrivilege` (a token privilege routinely granted to IIS worker processes) as the vector, compatible with the **"Potato"** family of tools, or via SPECTRE's built-in escalation capability.
    
9.  **Operational case record:** the most significant finding — a detailed log of an actual active intrusion, including target hostnames, backend/frontend IP addresses, the exploited page path, .NET runtime version, and the MachineKey values used. Notably, a MachineKey is scoped **at the IIS site level**, meaning keys extracted from one virtual host **cannot** be applied to co-hosted sites.
    

**Four AI-generated Python scripts** were also recovered from the actor's infrastructure:

*   `check_paths.py` — a post-exploitation diagnostic script running 5 sequential OOB callback tests to a `webhook.site` endpoint: confirming baseline write capability, exfiltrating the webroot's ACL (via `icacls`), attempting direct file writes and capturing exact exceptions on failure, querying IIS physical paths via `appcmd list vdir`, and probing multiple candidate subdirectories.
    
*   `deploy_implant.py` — uses the same ViewState deserialization primitive to download and launch the **SPECTRE** implant; after a 6-second sleep, runs a PowerShell probe (`Test-Path`, `Get-Item.Length`) to verify deployment, reporting results via webhook. Includes a fallback using `New-Object Net.WebClient` if `certutil` fails.
    
*   `deploy_shell.py` — deploys a durable ASHX web shell (`sss.ashx`) in two steps: writing a temporary handler (`up.ashx`, an 8-line C# handler, Base64-encoded + `PowerShell [IO.File]::WriteAllBytes`), then using that handler as an HTTP relay to upload the final web shell (preferring a hardcoded local path on the attacker's machine, with a fallback to a secondary staging server at `139.180.197[.]150:54321`). Analysis revealed the username **"dajiba"** on the attacker's machine — the pinyin romanization of a vulgar Chinese term.
    
*   `exfil.py` — blends exfiltration traffic with legitimate SaaS traffic over HTTPS to `webhook.site`, in three stages: webroot enumeration, IIS site inventory (`appcmd.exe list site`), and privilege assessment (`whoami /priv`) to determine viability for Potato-family privilege escalation.
    

**A findings log** documents a confirmed RCE via ASP.NET ViewState deserialization on a real IIS target — more than 12 HTTP callbacks confirming four distinct ysoserial gadget chains functioning on .NET 4.8.4797.0, along with reconnaissance data: the webroot contained 13 site directories, and `SeImpersonatePrivilege` was enabled (opening a viable path for Potato-family escalation).

### 5\. SPECTRE — A New Cross-Platform Backdoor

SPECTRE is a backdoor written in **C**, supporting both **Windows and Linux**, named by Talos based on a debug log recovered from one sample. The first observed use of this implant dates to **April 2026**.

![](https://cdn.hashnode.com/uploads/covers/669e2578c18c3baa1b4fc070/095661e3-d310-4489-a2c2-874a47e31016.png align="center")

#### Windows Version

Not the stock Havoc framework — SPECTRE features custom post-exploitation and defense-evasion capabilities compiled directly into the binary, with a dual-layer obfuscation strategy:

1.  **API resolution entirely at runtime** via PEB hash walking (a DJB2 variant algorithm).
    
2.  **String encryption** using a **per-string xorshift32** pseudorandom number generator (PRNG) — sensitive literals are encrypted at compile time with unique 32-bit seeds, decrypted to Thread Local Storage immediately before use, and **never stored in plaintext** within the `.text`/`.rdata` sections.
    

SPECTRE also features a **weighted anti-analysis scoring routine**, evaluating: process name blocklists, RAM capacity, CPU core count, disk space, sleep-acceleration detection, and common sandbox host/usernames. If the cumulative score reaches **50 or higher**, the process self-terminates.

**C2:** communicates via HTTP POST to the `/api/v1/register` and `/api/v1/output` endpoints; a fallback C2 domain is hardcoded (recoverable via string decryption). Notably, one variant reads its **C2 configuration from an NTFS Alternate Data Stream (ADS)** at `C:\Windows\System32\drivers\etc\hosts:cache` — allowing the actor to **update C2 configuration simply by modifying the ADS**, evading firewall blocklists **without recompiling the binary**.

**Command set:** Talos identified **45 commands** — 24 plaintext, 21 encrypted with the xorshift PRNG (decrypted at each dispatch). The encrypted commands concentrate on three sensitive capability groups:

| **Capability Group** | **Representative Commands** | **Description** |
| --- | --- | --- |
| **Process Injection** | `inject`, `s-nject`, `earlybird`, `hollow` | Three methods: process hollowing (default `svchost.exe`); APC EarlyBird injection (delivering shellcode before the target thread executes its first instruction); automated on-startup self-hollowing targeting `RuntimeBroker.exe`, executed directly from `main()` to conceal the implant |
| **Privilege Escalation & Credential Theft** | `getsystem`, `steal_token`, `make_token`, `hashdump`, `vaultdump`, `chromedump` | Named pipe impersonation (`\\.\pipe\spectre_<tid>` + `ImpersonateNamedPipeClient`) to obtain a SYSTEM token; saves three registry hives (SAM, SYSTEM, SECURITY) to `%TEMP%` via `RegSaveKeyA` for offline NT hash extraction via `secretsdump.py`; **Vaultdump** enumerates Windows Credential Manager via `cmdkey.exe /list` (no LSASS access needed); **Chromedump** copies Chrome/Edge Login Data + Local State for offline DPAPI decryption via SharpChrome |
| **BYOVD EDR Killer** | `byovd_load`, `byovd_unload`, `edr_kill`, `callbacks`, `byovd_verify` | See details below |

The 24 plaintext commands cover basic operations: `shell`/`sh`, `pwd`/`cd`, `ls`, `cat`, `mkdir`, `rm`, `cp`, `mv`, `download`, `upload`, `ps`, `kill`, `env`, `sleep`, `sysinfo`, `screenshot`, `whoami`, `netinfo`, `timestomp`, `rev2self`, `getprivs`, `selfdel`, `reg`, `exit`.

**BYOVD Mechanism (Bring Your Own Vulnerable Driver):** SPECTRE downloads **one of two well-known vulnerable drivers** from the C2 — MSI's `RTCore64.sys` (**CVE-2019-16098**) or Dell's `DBUtil_2_3.sys` (**CVE-2021-21551**). The driver is decoded, written to `%TEMP%`, installed as a transient kernel service via the Service Control Manager, then an IOCTL handle is opened to the device. Leveraging the arbitrary kernel read/write primitives exposed by these drivers, SPECTRE uses `NtQuerySystemInformation` to locate `ntoskrnl.exe` in kernel address space, then references a **hardcoded offset table covering 13 Windows versions** to calculate the exact kernel virtual addresses for `PspCreateProcessNotifyRoutine`, `PspCreateThreadNotifyRoutine`, and `PspLoadImageNotifyRoutine`. Through targeted kernel writes, SPECTRE **safely unlinks each registered EDR callback from its doubly-linked list**. As a result, kernel-callback-dependent security products such as **CrowdStrike Falcon, SentinelOne, Microsoft Defender**, and other well-known EDR vendors are rendered **completely blind** to new process creation, thread creation, and image load events for the rest of the session — fully neutralizing EDR visibility on the target machine.

#### Linux Version

A **statically-linked** ELF x86-64 binary. Upon execution, SPECTRE immediately invokes an **eight-factor anti-sandbox scoring engine** before establishing a C2 connection; if the cumulative score reaches the threshold of 50, the binary **exits silently, generating no observable indicators**. Following successful validation, SPECTRE beacons to a hardcoded C2 domain with a JSON payload — identical in structure to the Windows version.

Rather than 45 commands, the Linux version has only **29 commands, none obfuscated or encrypted**: basic file system operations (`ls`, `cat`, `mkdir`, `rm`, `cp`, `mv`, `download`, `upload`), system/process reconnaissance (`ps`, `sysinfo`, `whoami`, `id`, `netinfo`), agent management (`sleep`, `kill`, `selfdel`, `exit`), unrestricted shell execution (`shell`/`/bin/sh`), and notably `timestomp` — an anti-forensics mechanism using `utimensat()` and operator-provided timestamps to alter a file's modification, access, and change times.

**Its most critical capability:** a dedicated command set (`rootkit_load`, `rootkit_hide`, `rootkit_root`, `rootkit_hide_mod`, `rootkit_status`, `rootkit_persist`, `rootkit_unload`) controlling an **integrated kernel-level rootkit called "Specter,"** deployed as a loadable kernel module **disguised as** `acpi_pad.ko` (mimicking the legitimate ACPI processor power management module). For persistence, the rootkit uses a **fraudulent systemd unit named** `hardware-monitor.service`, described as "Hardware Performance Monitor," and critically — configured with `Before=sysinit.target`, ensuring the rootkit **executes before any security tooling initializes**, on every system boot.

User-level communication with the loaded kernel module occurs via a **signal-based IPC mechanism**: issuing `kill()` syscalls targeting a **magic PID value of** `0x7A69` (decimal 31337 — the well-known "elite"/leet hacker-culture number) with specific real-time signal numbers encoding the desired operation:

*   **Signal 62:** triggers process hiding — removes the target `task_struct` from the kernel's PID list, rendering `/proc/<pid>` invisible.
    
*   **Signal 36:** hides the module itself from `lsmod` — unlinks `THIS_MODULE` from the kernel module linked list.
    
*   **Signal 37:** escalates the implant process to UID 0 — directly overwrites the process credential structure.
    
*   **Signal 35:** serves as a module-load acknowledgment handshake.
    

### 6\. Specter — The Linux Kernel Rootkit

The SPECTRE backdoor loads a Linux kernel rootkit named **Specter** to prevent detection by security products. Rather than patching the syscall table (an older, more detectable technique), the rootkit uses the Linux kernel's **native "ftrace" instrumentation framework** — a legitimate kernel debugging interface — with the flag `FTRACE_OPS_FL_IPMODIFY` to redirect execution at the function entry point of **six syscall handlers**:

*   `hooked_tcp6_seq_show`
    
*   `hooked_tcp4_seq_show`
    
*   `hooked_tkill`
    
*   `hooked_tgkill`
    
*   `hooked_kill`
    
*   `hooked_getdents64`
    

Because `ftrace` is a legitimate kernel debugging interface, this approach produces **minimal noise** in kernel integrity checks.

### 7\. Evidence of AI-Assisted Development in the Rootkit Itself

This is arguably the most notable finding of the entire report. Talos assesses with **medium confidence** that UAT-10147 combined **AI-assisted development and human expertise** to create the Specter rootkit, based on three pieces of evidence:

1.  **Documentation structure:** the feature list at the top of the source code reads like a "product spec," not a developer's notes — resembling a direct response to a prompt like *"Write a rootkit with the following features."* This is the AI narrating what it is about to produce.
    
2.  **Rigid, uniform decorative separators:** identical width and formatting applied consistently across 10+ logical sections — a machine-like uniformity that is a classic hallmark of AI-generated output. The text also carries a **pedagogical tone**: a real developer writing a rootkit wouldn't need to explain basic concepts to themselves, such as taint flags or how to run `cat /proc/sys/kernel/tainted` — content clearly structured as an educational explanation for a reader, rather than authentic internal developer notes.
    
3.  **The inclusion of three distinct methods** for the same purpose, explicitly labeled "Method 1," "Method 2," "Method 3" — a common artifact of AI generation. When prompted to be thorough, AI models tend to output **every known approach**; by contrast, a human developer targeting a specific kernel would simply select and implement the **single most effective method**. This exhaustive, multi-method presentation is a classic example of an AI's "completeness reflex."
    

Additional evidence lies in the self-compiled **"Potato" family** privilege-escalation tools (EfsPotato, RustPotato): PDB strings and local paths reveal the actor building these tools in a directory literally named **"AI"** (`C:\Users\iis\Desktop\AI\EfsPotatoCpp\...`, `C:\Users\Intel\Desktop\AI\EfsPotatoCPP\...`) — a small but strong detail reinforcing the hypothesis that the actor is leveraging AI to assist in developing its custom tooling.

### 8\. SEO Fraud Tooling — Deliberately Targeting Vietnamese Internet Users

UAT-10147 deploys **two types** of SEO fraud tools with fundamentally different persistence mechanisms:

**a) BadIIS (Malware-as-a-Service)** — the core variant confirmed to be **the exact same sample** documented in Talos's earlier research on the BadIIS MaaS ecosystem (characterized by the `demo.pdb` string), operating as a **Malware-as-a-Service** used by **multiple Chinese-speaking cybercrime groups** — not exclusively UAT-10147.

**b) ASHX SEO Engine** — a new C# ASHX web handler that **silently takes over an IIS application's request pipeline via reflection**. Functionally similar to standard BadIIS: serves fabricated content to search crawlers to poison rankings, while delivering malicious JavaScript to targeted users. The class is explicitly named `SeoEngineHandler`.

**The key finding:** the handler's internal configuration reveals it was **specifically designed to target Vietnamese internet users**:

*   Configured C2 domains use the `vn.xyz` suffix.
    
*   The malware **explicitly targets the crawler for "Cốc Cốc"** (configured as `coccoc`) — a prominent Vietnamese web browser and search engine.
    

This is **not** an incidental or secondary detail — it is direct evidence that Vietnamese internet users fall within the **deliberate targeting scope** of this SEO-fraud tool, rather than being incidental victims in a global scanning campaign.

### 9\. The "Potato" Privilege Escalation Family

The actor uses multiple "Potato" family tools to achieve system-level privileges. Some, like **GodPotato** and **JuicyPotato**, were downloaded as precompiled binaries; others, like **EfsPotato** and **RustPotato**, were **self-compiled from source**. As noted in Section 7, PDB strings and local file paths exposed in these self-compiled payloads reveal details of the actor's development environment — including a build directory named "AI."

### 10\. Other Backdoors for Persistence

**Web shell:** a sophisticated **two-layer architecture**. The outer handler functions as a self-bootstrapping loader that leverages in-memory dynamic compilation to execute its payload. Upon receiving the first HTTP request, the handler reverses an obfuscated string, decodes it via Base64, and dynamically compiles the resulting code in memory using `CodeDomProvider`. To optimize execution and ensure thread safety, it caches the compiled assembly in a static field (`_a`) using double-checked locking, ensuring the payload is compiled **only once per IIS worker process lifetime**. The embedded handler functions as a versatile web shell, relying on a numeric parameter to dispatch operational modes, with strict multi-tiered authentication: it inspects the `X-ID` HTTP header for a specific token; if absent, it falls back to a `v` parameter; if neither matches the exact value `"x9"`, the handler **immediately halts and returns a deceptive "404 Not Found" error** — allowing the covert authentication process to blend seamlessly into routine HTTP traffic.

| **Command** | **Function** |
| --- | --- |
| 0 (default) | Get system information (MachineName / Username / OSVersion / CurrentPath) |
| 1 | Execute system command (`b` = binary to run, default `cmd.exe`; `g` = arguments) |
| 2 | Read file |
| 3 | Write file |
| 4 | Direct file download |
| 5 | Directory listing |

**Meterpreter:** reverse Meterpreter shells deployed to maintain persistent access to compromised Linux hosts — functioning as a first-stage shellcode dropper that, upon a successful connection, retrieves a second-stage payload to establish persistence and full C2.

**Noodle RAT:** the **Type 0x03A2** ELF variant (previously documented by Trend Micro) — deployed as a final-stage backdoor for persistent Linux access.

**Quasar RAT:** a notable characteristic is its configured **Campaign ID**, which contains **a derogatory Chinese-language term targeting elderly Vietnamese people**. While not technically significant, this artifact offers insight into the actor's sentiment or specific geographic targeting — further reinforcing the Vietnam-targeting evidence noted in Section 8.

**Gh0stCringe:** embedded as shellcode within a **custom Go-based loader** to evade detection.

* * *

## Risk Summary

| **Risk Dimension** | **Level** | **Rationale** |
| --- | --- | --- |
| **EDR bypass capability** | Critical | BYOVD fully neutralizes kernel callbacks for CrowdStrike, SentinelOne, Defender, and other EDR products |
| **Persistence** | Very High | Linux kernel rootkit runs before any security tooling initializes at boot; survives reboots |
| **Stealth** | Very High | Dual obfuscation (PEB hash walking + xorshift32), anti-sandbox scoring on both platforms, low-noise ftrace hooking |
| **AI-driven scale** | Very High | AI assists every phase: exploitation, reconnaissance, payload generation, validation, operational documentation |
| **Blast radius** | High | 170,000 URLs on the target list; confirmed victims span five countries and multiple sectors |
| **Credential theft** | High | Dumps SAM/SYSTEM/SECURITY hives, Credential Manager, Chrome/Edge login data |
| **Vietnam-targeting severity** | Concerning | SEO fraud module specifically configured for Vietnamese users (Cốc Cốc, `vn.xyz` domain); Vietnam is among confirmed victims |

* * *

## IOCs & Artifacts

### Network Indicators

| **Indicator** | **Type** | **Role** |
| --- | --- | --- |
| `139.180.197[.]150` | IP | Primary open directory / download server; also used port `54321` as a secondary staging server |
| `adminapi.tippusoni[.]in` | Domain | Hosts EfsPotato, Quasar RAT, BadIIS, and deployment scripts |
| Domains with `vn.xyz` suffix | Domain pattern | C2 for the ASHX SEO Engine, targeting Vietnamese users |

### Host-based Indicators

*   **Scheduled Task:** `Google Chrome Start` (runs the backdoor at every logon with the highest privileges).
    
*   **Batch scripts:** `back.txt`/`back.bat`, `bai.bat`/`bai.txt`, `user.txt`/`user.bat`.
    
*   **Evasive renaming:** EfsPotato renamed to `prcc1.rar`; Quasar RAT disguised as `svchosts.exe`.
    
*   **Reverse shell DLL (from CVE-2019-18935):** naming convention `[10 digits].[7 digits].dll`.
    
*   **Masqueraded kernel module:** `acpi_pad.ko`.
    
*   **Fake systemd unit:** `hardware-monitor.service` (described as "Hardware Performance Monitor," `Before=sysinit.target`).
    
*   **Magic PID (rootkit IPC):** `0x7A69` (31337).
    
*   **Web shell authentication:** `X-ID` header or `v` parameter = `"x9"`.
    
*   **ASHX web shell:** `sss.ashx`, temporary handler `up.ashx`.
    
*   **SEO engine class:** `SeoEngineHandler`, targeted crawler `coccoc`.
    
*   **Abused Windows Defender exclusion paths:** `C:\Windows\System32\inetsrv`, `C:\Windows\SysWOW64\inetsrv`.
    
*   **NTFS ADS used for C2 config storage:** `C:\Windows\System32\drivers\etc\hosts:cache`.
    

### PDB Paths (Attribution Evidence)

```plaintext
C:\Users\Administrator\Desktop\2025-11-21 (x神订制全站劫持按浏览器语言跳转)\dll\Release\demo.pdb
C:\Users\Administrator\Desktop\2025-11-21 (x神订制全站劫持按浏览器语言跳转)\dll\x64\Release\demo.pdb
C:\Users\Administrator\Desktop\x神的自安装服务\svchost\x64\Release\service.pdb
C:\Users\iis\Desktop\AI\EfsPotatoCpp\x64\Release\EfsPotato.pdb
C:\Users\Intel\Desktop\AI\EfsPotatoCPP\x64\Debug\EfsPotato.pdb
```

### Weaponized CVEs (Summary)

| **CVE** | **Product/Component** | **Type** |
| --- | --- | --- |
| CVE-2022-27925 | Zimbra Collaboration Suite | Unauthenticated RCE |
| CVE-2021-23758 | AjaxPro | Deserialization RCE |
| CVE-2021-29441 / CVE-2021-29442 | Alibaba Nacos | Arbitrary code execution |
| CVE-2019-18935 | Telerik UI for ASP.NET AJAX | JSON deserialization RCE |
| CVE-2022-0995 | Linux kernel (watch\_queue) | LPE |
| CVE-2021-3156 | sudo ("Baron Samedit") | LPE |
| CVE-2015-5287 | ABRT sosreport | LPE |
| CVE-2015-3246 | libuser roothelper | LPE |
| CVE-2010-3904 | Linux kernel RDS | LPE |
| CVE-2022-0847 | Linux kernel ("Dirty Pipe") | LPE |
| CVE-2019-16098 | MSI RTCore64.sys | BYOVD |
| CVE-2021-21551 | Dell DBUtil\_2\_3.sys | BYOVD |

> **Complete IOC list (hashes, additional domains):** Cisco Talos published detailed IOC repositories on GitHub — see References below.

### Coverage (Detection Signatures Published by Talos)

**ClamAV:** `Py.Loader.Tool-10060293-1/2`, multiple `Win.Malware.Generic` variants, `Win.Loader.Downloader-10060287-1`, `Win.Malware.BadPotato-10060230-0`, `Unix.Rootkit.Malware-10060258-0`, `Unix.Rootkit.Spectre-10060260-0`, `Unix.Backdoor.Msfvenom-10012672-0`, `Win.Malware.BadIIS-10059985-0`, `Asp.Rootkit.Badiis-10060290-1`, and additional signatures (see original source for the complete list).

**Snort:** SIDs `1:66688`, `1:66689`, `1:66690`, `1:66696`, `1:66697`, `1:301548` (Snort2/Snort3).

* * *

## MITRE ATT&CK Mapping

| **Tactic** | **Technique ID** | **Technique Name** | **Description in Campaign** |
| --- | --- | --- | --- |
| **Initial Access** | T1190 | Exploit Public-Facing Application | The entire initial RCE chain across Zimbra, AjaxPro, Nacos, Telerik CVEs, and custom exploits |
| **Execution** | T1059.001 / T1059.003 / T1059.004 | Command and Scripting Interpreter (PowerShell / Windows Batch / Unix Shell) | The `back.bat`, `bai.bat`, `user.bat` scripts; SPECTRE's `shell`/`sh` command |
| **Persistence** | T1053.005 | Scheduled Task/Job | "Google Chrome Start" task |
| **Persistence** | T1543.002/.003 | Create or Modify System Process (Systemd Service / Windows Service) | Fake `hardware-monitor.service`; BadIIS service installer |
| **Persistence** | T1505.003 | Server Software Component: Web Shell | Two-layer web shell; ASHX web shell `sss.ashx` |
| **Persistence** | T1136 | Create Account | Rogue local admin account creation, added to RDP group |
| **Privilege Escalation** | T1068 | Exploitation for Privilege Escalation | Six LPE CVEs on Linux; EfsPotato/GodPotato/JuicyPotato/RustPotato on Windows |
| **Privilege Escalation** | T1134 | Access Token Manipulation | SPECTRE's named pipe impersonation, `steal_token`, `make_token` |
| **Privilege Escalation** | T1055 / T1055.012 | Process Injection / Process Hollowing | `inject`, `hollow`, `earlybird` (APC EarlyBird) on SPECTRE Windows |
| **Defense Evasion** | T1562.001 | Impair Defenses: Disable or Modify Tools | Adding Windows Defender exclusions for IIS directories and malware |
| **Defense Evasion** | T1014 | Rootkit | The "Specter" Linux rootkit (ftrace hooking) |
| **Defense Evasion** | T1622 / T1497 | Debugger/Sandbox Evasion | Weighted anti-sandbox scoring on both Windows and Linux |
| **Defense Evasion** | T1027 | Obfuscated Files or Information | xorshift32 string encryption; PEB hash walking API resolution |
| **Defense Evasion** | T1070.004 / T1070.006 | Indicator Removal (File Deletion / Timestomp) | Deleting staging payloads; `timestomp` command |
| **Defense Evasion** | T1564.001 | Hide Artifacts: Hidden Files and Directories | `rootkit_hide` (process hiding from `/proc`), `rootkit_hide_mod` (hiding from `lsmod`) |
| **Defense Evasion** | T1036 | Masquerading | `acpi_pad.ko`, "Google Chrome Start," the web shell's fake 404 |
| **Credential Access** | T1003.002 | OS Credential Dumping: SAM | Dumping SAM/SYSTEM/SECURITY hives via `RegSaveKeyA` |
| **Credential Access** | T1555.003 / T1555.004 | Credentials from Web Browsers / Windows Credential Manager | `chromedump`, `vaultdump` |
| **Credential Access** | T1552 | Unsecured Credentials | Exploiting leaked/public MachineKeys via `badsecrets` |
| **Discovery** | T1082 / T1057 / T1083 / T1016 | System/Process/File/Network Discovery | `sysinfo`, `ps`, `ls`, `netinfo` commands; recon via `appcmd`, `whoami /priv` |
| **Collection** | T1113 / T1056.001 | Screen Capture / Keylogging | `screenshot`, `keylog_start/stop/dump` |
| **Command and Control** | T1071.001 | Application Layer Protocol: Web Protocols | HTTPS to `/api/v1/register`, `/api/v1/output` |
| **Command and Control** | T1102 | Web Service | The Nacos config server and `webhook.site` as exfiltration sinks |
| **Exfiltration** | T1041 / T1567 | Exfiltration Over C2 Channel / Web Service | Reconnaissance data exfiltrated via webhook, Nacos |

* * *

## Assessment

UAT-10147 is one of the **clearest and most systematic examples** to date of a **purely criminal** threat actor (not a nation-state APT) leveraging agentic AI **throughout the entire attack lifecycle** — not merely to write supporting scripts, but to iteratively refine exploits, troubleshoot adaptively, automate post-exploitation, validate exploits, and generate complete operational documentation. The fact that AI produced a **9-section exploitation guide** — including **correcting a common technical misconception found on the public internet**, logging an actual operational case, and documenting a "defensive blind spot" (HTTP 500 = success) — suggests the actor is using AI as **a diligent, meticulous junior teammate**, not merely a command-typing assistant.

More concerning still, evidence of AI-assisted development appears directly within the **Linux kernel rootkit itself** — documentation structured like a "product spec," a pedagogical tone explaining basic concepts, and a "completeness reflex" listing three methods for the same goal. This signals that AI is no longer confined to assisting with high-level attack scripting, but is **creeping into kernel-level malware development** — a domain that previously required deep expertise and was rarely accessible to run-of-the-mill cybercriminals.

**UAT-10147's attack chain requires no zero-days whatsoever.** It relies entirely on publicly known vulnerabilities (one-days), misconfigurations, and leaked secrets (MachineKeys). This reaffirms a fundamental defensive principle: **timely patch management and secret hygiene remain the most effective defenses**, regardless of how sophisticated an adversary's AI assistance becomes. At the same time, the fact that an ordinary cybercrime group now has access to **kernel-level BYOVD EDR neutralization** and an **ftrace-based Linux rootkit** — techniques once nearly exclusive to nation-state APT groups — shows that the capability gap between cybercrime and APT is **rapidly narrowing**, in no small part because AI lowers the skill barrier required.

**For organizations in Vietnam, this is a specific, direct warning — not a generic risk.** UAT-10147 does not merely happen to have Vietnamese victims: the group operates an SEO-fraud module **specifically configured to target Cốc Cốc** and uses C2 domains with a `vn.xyz` suffix — evidence of a **deliberate campaign targeting Vietnamese internet users**, combined with the fact that Vietnam already appears among the five countries with confirmed compromised servers. Vietnamese organizations running internet-facing IIS or Linux servers — particularly in government, education, media, technology, and gaming — should treat this as an **active, deliberately targeted threat**, not a theoretical risk.

* * *

## Recommendations

### Patching & Attack Surface Management (Highest Priority)

1.  **Patch the CVEs listed above immediately** — especially Zimbra (CVE-2022-27925), Telerik UI (CVE-2019-18935), and Nacos (CVE-2021-29441/29442) if your organization uses these products.
    
2.  **On Linux servers:** prioritize patching `sudo` (CVE-2021-3156) and the kernel (Dirty Pipe, CVE-2022-0847) — the two most dangerous and widespread LPE vulnerabilities in the list.
    
3.  **Protect ASP.NET MachineKeys:** never use default or publicly known `MachineKey` values; audit internal ASP.NET applications with tools like `badsecrets` to proactively catch leaked keys before an attacker does.
    

### Windows Detection

1.  **Monitor for anomalous Windows Defender exclusion list changes**, especially paths like `System32\inetsrv`, `SysWOW64\inetsrv`, or any directory added via PowerShell/Registry immediately following suspicious execution activity.
    
2.  **Alert on installation of uncommon kernel drivers** (especially `RTCore64.sys`, `DBUtil_2_3.sys`) — a classic BYOVD indicator; consider deploying the Microsoft Vulnerable Driver Blocklist.
    
3.  **Audit scheduled tasks named "Google Chrome Start"** or any task disguised as legitimate software but pointing to an anomalous binary/path.
    
4.  **Inspect NTFS Alternate Data Streams** on sensitive system files such as `hosts` — an unusual ADS may hide C2 configuration.
    
5.  **Monitor new local admin account creation** paired with addition to the Remote Desktop Users group.
    

### Linux Detection

1.  **Audit loaded kernel modules**, especially those with legitimate-sounding names (`acpi_pad` and variants) but anomalous hashes or origins.
    
2.  **Check new systemd units**, especially those configured with `Before=sysinit.target`— a strong indicator of a persist-before-security-tooling technique.
    
3.  **Monitor** `kill()` **syscalls targeting non-existent or anomalous PIDs** (such as `31337`) — a signature of signal-based rootkit IPC.
    
4.  **Inspect unusual ftrace usage** — while a legitimate API, an unrecognized process registering ftrace hooks on sensitive syscalls is a suspicious signal.
    

### General

1.  **Treat any persistent backdoor as a starting point for privilege escalation + BYOVD**, not just a surface-level malware removal task.
    
2.  **For Vietnamese organizations with public-facing web presence:** review access logs for anomalous bot/crawler activity related to `coccoc` or browser-language-based redirects — a signature of the Vietnam-targeting SEO fraud module.
    
3.  **Deploy EDR capable of detecting BYOVD** (monitoring new kernel driver installations, not relying solely on traditional callbacks — since those very callbacks can be neutralized).
    
4.  **Conduct proactive threat hunting** using the published IOCs (see References) — especially PDB paths and strings related to "x神."
    

* * *

## References

*   [UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations — Cisco Talos (Joey Chen, August 20, 2026)](https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/)
    
*   [UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities — Cisco Talos (Joey Chen, August 20, 2026)](https://blog.talosintelligence.com/uat-10147-deploys-spectre-a-cross-platform-implant-with-linux-rootkit-and-byovd-capabilities/)
    
*   [From PDB strings to MaaS: Tracking a commodity BadIIS ecosystem — Cisco Talos (background research on BadIIS MaaS and "x神")](https://blog.talosintelligence.com/from-pdb-strings-to-maas-tracking-a-commodity-badiis-ecosystem/)
    
*   [Cisco Talos IOC Repository — "UAT-10147 integrates agentic AI" (GitHub)](https://github.com/Cisco-Talos/IOCs/tree/main/2026/08)
    
*   [Cisco Talos IOC Repository — "UAT-10147 deploys SPECTRE" (GitHub)](https://github.com/Cisco-Talos/IOCs/tree/main/2026/08)