UAT-10147: The Commodity Crime Gang That Hired AI Pentesters (And Wrote a Rootkit While It Was At It)

How they were caught: an open directory//

Cisco Talos published two posts on 2026-08-20 documenting UAT-10147, a financially motivated, Chinese-speaking cybercrime group. Not a nation-state. Not a well-funded shop. A crew whose business model is SEO fraud (serving fake content to search crawlers via the BadIIS malware) and data theft off internet-exposed web servers in government, education, media, technology, and gaming organizations — with observed victims in Brazil, Bolivia, China, Canada, and Vietnam.

They got caught the classic way: OPSEC. A compromised machine was talking to a download server at 139.180.197[.]150 that had directory listing turned on. Talos walked in and found the group's tooling, its workflow, and a target list of roughly 170,000 URLs — so the crew split it into 17 files of ~10,000 each (the operators use the letter "w" for the Chinese character 萬, which means ten thousand). That's the entire threat: a spreadsheet of targets and a lot of automation.

"Agentic AI" — not a chatbot, an employee//

The important line from Talos is the assessment (moderate-to-high confidence) that UAT-10147 is part of an "emerging class of financially motivated intrusion operators leveraging agentic AI systems to operationalize offensive tradecraft at scale."

This is not "they used ChatGPT to draft a phishing email." The recovered workflow shows:

• PentestGPT — an autonomous pentesting framework installed on their C2 server, scanning web servers and executing relevant proof-of-concept exploits without a human picking each target by hand.
• DeepAudit — a source-code vulnerability-scanning framework on their management server, for finding vulns in target website source and third-party packages.
• AI-generated ysoserial playbooks — the AI wrote the README on how to run the deserialization toolkit, and the operator used AI to quality-check the exploit (validate it actually works against the target).
• Four AI-written Python scripts that automate a complete ASP.NET ViewState RCE chain: check_paths.py (five out-of-band callback tests to diagnose which directories are writable), deploy_implant.py (downloads and launches the SPECTRE implant, verifies it landed), deploy_shell.py (two-step deployment of an ASHX web shell), and exfil.py (three-stage recon/exfil over HTTPS to a webhook.site endpoint).
• A nine-section AI-generated exploitation guide documenting an active intrusion against a real target — hostnames, IPs, the MachineKey values used, even a low-noise trick for validating a stolen MachineKey by deliberately triggering a distinguishable HTTP 500 error before committing to full exploitation. On one confirmed box they received 12+ HTTP callbacks while testing four distinct ysoserial gadget chains against .NET 4.8.

That last one is the pattern: iterative, AI-assisted refinement rather than a single scripted attempt.

The infection chain, briefly//

Initial access runs on known one-day vulnerabilities weaponized through Metasploit, the same public CVEs you've seen in the news: CVE-2022-27925 (Zimbra), CVE-2021-23758 (AjaxPro), CVE-2021-29441/29442 (Nacos), CVE-2019-18935 (Telerik). On Linux, post-exploitation privilege escalation leans on a shelf of classics: CVE-2021-3156 (Baron Samedit), CVE-2022-0847 (Dirty Pipe), CVE-2022-0995, CVE-2015-5287, CVE-2015-3246, CVE-2010-3904 — then deploys NoodleRAT, SPECTRE, and Meterpreter. On Windows it's the Potato family (EfsPotato, RustPotato, GodPotato, JuicyPotato) plus a scheduled task named "Google Chrome Start" for persistence.

One fun artifact: the group's custom-compiled privesc tools carry PDB paths that point into a build directory literally named C:\Users\iis\Desktop\AI\. They're compiling privesc tooling out of an "AI" folder.

SPECTRE: the implant//

SPECTRE is a cross-platform backdoor written in C (named after a debug log found in a sample). The Windows variant has 45 commands — half of them encrypted with per-string xorshift32 so static scanners can't see them — process hollowing, EarlyBird APC injection, a named-pipe impersonation path to SYSTEM, credential dumping (SAM/SYSTEM/SECURITY hives, Vault, Chrome/Edge login data), and a timestomp command for anti-forensics.

The headline feature is the BYOVD EDR killer: SPECTRE downloads a known-vulnerable kernel driver (RTCore64.sys from MSI, CVE-2019-16098, or DBUtil_2_3.sys from Dell, CVE-2021-21551), installs it as a transient service, and uses its arbitrary kernel read/write to unlink the EDR's kernel callbacks (process-create, thread-create, image-load) from the kernel's callback lists. Result: your EDR is completely blind to new processes, threads, and image loads for the rest of the session. Same drivers BlackByte and Lazarus have used before — nothing new, but a commodity crew using them is the point.

Specter: the Linux rootkit, and the boot-order trick//

The Linux variant carries an integrated kernel rootkit, Specter. The details that matter for a Linux host:

• Deployed as a loadable kernel module disguised as acpi_pad.ko — masquerading as the legitimate ACPI processor power-management module.
• Persisted by a fake systemd unit, hardware-monitor.service, described as "Hardware Performance Monitor."
• The unit is configured with Before=sysinit.target, which means the rootkit loads on every boot, before any of your security tooling gets a chance to start.
• It hooks six syscall handlers (tcp6_seq_show, tcp4_seq_show, tkill, tgkill, kill, getdents64) through the kernel's native ftrace framework, so it looks like ordinary kernel debugging instrumentation and produces minimal noise in integrity checks.
• User-space talks to it by sending real-time signals to a magic PID 31337 (signal 62 hides a process from /proc, 36 hides the module from lsmod, 37 elevates the implant to UID 0).

And the detail that made the AI angle concrete: Talos assesses with medium confidence that the rootkit's development was AI-assisted. The source code opens with a bulleted "product spec" feature list that reads like a response to a prompt ("Write a rootkit with the following features"), has machine-uniform decorative separators, pedagogical explanations a developer wouldn't write for themselves, and three explicitly-labeled "Method 1/2/3" approaches where a human would just pick the one that works.

Why it matters: mid-tier is enough//

The Cloud Security Alliance's research note (2026-08-24) frames it best: this matters less for any single technical innovation than for what it represents: a mid-tier, financially motivated actor compressing the skill and time that post-compromise operations traditionally require. CSA notes UAT-10147 is a third independently-developed data point in 2026 of the same shape (autonomous recon/exploitation by non-nation-state actors). The commodity reasoning model + orchestration framework + scanning tooling stack is arriving at similar solutions without coordination.

What to do tonight//

1. Patch the one-days they actually used. Zimbra (CVE-2022-27925), Nacos (CVE-2021-29441/2), AjaxPro (CVE-2021-23758), Telerik (CVE-2019-18935) — and on Linux hosts, make sure Baron Samedit and Dirty Pipe are closed. These are all years old; if you're still exposed, you're on their list.
2. Hunt Windows boxes for the "Google Chrome Start" scheduled task and for Defender exclusion paths on System32\inetsrv / SysWOW64\inetsrv.
3. Hunt Linux hosts for the fake rootkit: check lsmod for an acpi_pad module you didn't load, and systemctl list-unit-files | grep hardware-monitor. A hardware-monitor.service with Before=sysinit.target on a box that has no hardware performance monitor is a suspect.
4. Integrity-check your systemd units — the persistence is a file (/etc/systemd/system/hardware-monitor.service), so file-integrity monitoring and a find /etc/systemd -newer /some/baseline hunt both work.
5. If you run Snort/Suricata, Talos publishes SIDs for both posts. For the SPECTRE implant: Snort2: 1:66690, 1:66688, 1:66689; Snort3: 1:66690, 1:301548. The agentic-AI post has its own set (1:66697/1:66696); don't mix them.
6. Pull the IOCs and feed the hashes/URLs into whatever you've got.

The scary part isn't the malware. It's that a spreadsheet-and-a-subscription crew can now run what used to take a specialist team a month — and your internet-exposed box is a row in that spreadsheet.