The Vulnerabilities Were Old. AI Turned 170,000 Servers Into an Operational Queue.
Cisco Talos found approximately 170,000 URLs on infrastructure operated by UAT-10147. The list was divided into seventeen files of roughly 10,000 targets each, ready to be worked in manageable batches.
That number is not a victim count. It is evidence of an operational model.
The Chinese-speaking, financially motivated group did not need a new zero-day to build that model. It used publicly disclosed vulnerabilities in internet-facing Windows and Linux servers, then added AI-generated playbooks, validation scripts, troubleshooting logic and deployment workflows. Old weaknesses became inputs to a repeatable production system.
The important AI story is therefore not that a model independently invented a brilliant exploit. It is that the group used AI to reduce the expertise and attention required to move from a vulnerable server to a persistent, monetised compromise.
The target list shows intent, not 170,000 compromises
Talos discovered UAT-10147 after observing a compromised system communicate with an attacker-controlled download server. The server exposed an open directory containing tooling, malware, operational documents and the target list.
Resolving the URLs showed targets distributed across multiple countries. Talos confirmed affected servers in Brazil, Bolivia, China, Canada and Vietnam, belonging to government bodies, universities, media organisations, technology companies and gaming businesses.
The distinction between targeting and compromise matters. A URL in an operator’s queue may be patched, unreachable, misidentified or otherwise resistant to the attempted exploit. Talos has not reported 170,000 successful intrusions. It has reported an adversary that assembled and partitioned a list at that scale, then built automation to work through it.
That is still consequential. A financially motivated actor does not need a high success rate when the target pool is large, the vulnerabilities are known and the post-compromise work can be standardised.
The entry points were familiar
UAT-10147 targeted internet-facing IIS and Linux servers through previously disclosed weaknesses in products including Zimbra Collaboration, AjaxPro, Nacos and Telerik UI for ASP.NET AJAX. On Linux, the group also carried a broad collection of older local privilege-escalation exploits to move from application access to root.
This is not evidence that every product named by Talos remains universally vulnerable. Exposure depends on the deployed version, configuration and reachable attack surface. It is evidence that long-known weaknesses continue to provide viable access when organisations leave affected services online.
The attacker used Metasploit, ysoserial and other established offensive tools rather than replacing the entire intrusion stack with AI. After obtaining remote code execution, automated scripts downloaded privilege-escalation components and malware, changed security settings, created persistence and cleaned up staging files.
On Windows, one observed chain used EfsPotato to gain elevated privileges, added IIS directories to Microsoft Defender’s exclusion list, installed a rogue local administrator and Remote Desktop user, and created scheduled tasks with names designed to resemble legitimate Chrome activity.
On Linux, successful exploitation led to web shells, local privilege escalation and implants including Noodle RAT, Meterpreter and the group’s own SPECTRE backdoor.
AI became part of the operating procedure
Talos found PentestGPT and DeepAudit installed on the group’s management infrastructure. The observed uses went beyond asking a model to produce isolated code fragments.
Recovered material included an AI-generated guide for exploiting ASP.NET ViewState deserialisation. It documented prerequisites, payload construction, key validation, failure interpretation, out-of-band confirmation, reconnaissance, web-shell deployment and privilege escalation.
The workflow also produced companion scripts that checked writable paths, deployed the SPECTRE implant and installed a persistent shell. One document contained details from a real intrusion, including the target environment and the key material used. AI output had moved from generic advice into an operational case record.
Talos assesses with moderate-to-high confidence that UAT-10147 belongs to an emerging class of financially motivated operators using agentic systems to operationalise offensive tradecraft at scale. The evidence supports iterative exploit refinement, adaptive troubleshooting, validation and post-exploitation automation.
It does not establish that the entire campaign ran autonomously. Talos observed human expertise alongside AI-generated material, and the degree of human approval behind individual actions remains unknown. The responsible conclusion is semi-automated offensive orchestration, not an unsupervised machine independently compromising the internet.
SPECTRE turns one foothold into a cross-platform control system
Talos separately analysed SPECTRE, a custom backdoor written in C with Windows and Linux variants. The implant provides command execution, file transfer, reconnaissance, credential theft, process manipulation, persistence and anti-analysis features.
The Windows build contains 45 commands. It can inject into processes, impersonate tokens, dump registry hives, enumerate Windows Credential Manager entries, collect Chrome and Edge login databases, capture keystrokes and execute .NET assemblies in memory.
Its most serious defensive-evasion capability uses legitimate but vulnerable MSI or Dell drivers to obtain kernel read and write access. SPECTRE then removes registered callbacks used by security products to observe new processes, threads and image loads.
Talos says that this can blind products including CrowdStrike Falcon, SentinelOne and Microsoft Defender for the remainder of the session. The endpoint may still be running its security agent while losing important visibility into what the attacker does next.
That is operationally different from simply terminating one antivirus process. A responder can no longer assume that clean-looking endpoint telemetry describes a clean endpoint after the attacker reaches the kernel.
Linux receives a rootkit before security tooling starts
The Linux version of SPECTRE contains 29 commands and can load a kernel rootkit that Talos calls Specter. The module is disguised as acpi_pad.ko, imitating the name of a legitimate ACPI power-management component.
Persistence is provided by a fraudulent hardware-monitor.service unit described as a hardware performance monitor. Its configuration starts the rootkit before sysinit.target, placing it ahead of much of the security stack during every boot.
The rootkit can hide processes, conceal its own module and elevate the implant to root. It uses the Linux kernel’s legitimate ftrace instrumentation framework to redirect execution, which can produce less noise than older rootkits that modify the system-call table directly.
Talos assesses with medium confidence that the rootkit combines AI-assisted development with human expertise. The researchers point to unusually complete explanatory comments, rigid formatting and multiple alternative implementation methods. Those are indicators, not cryptographic proof of authorship, and Talos states the confidence boundary explicitly.
What defenders should hunt
- Inventory internet-facing web servers. Identify exposed IIS, Zimbra, Nacos, Telerik and related services, confirm supported versions and remove reachability that is not operationally required.
- Review Defender exclusions. Investigate unexpected exclusions for IIS directories, especially changes made through PowerShell or direct registry modification.
- Audit accounts and scheduled tasks. Look for unapproved local administrators, Remote Desktop group membership and tasks that imitate browser or maintenance activity.
- Monitor vulnerable-driver loading. Enforce Microsoft’s vulnerable-driver blocklist where applicable and investigate transient kernel services or MSI and Dell driver files appearing in temporary directories.
- Check Linux boot persistence. Search for unexpected
acpi_pad.komodules, ahardware-monitor.serviceunit and services configured to run unusually early in the boot sequence. - Do not trust one telemetry source. If kernel tampering is possible, compare endpoint data with network, identity, hypervisor, cloud and off-host logs.
- Use Talos coverage and indicators. Cisco published Snort and ClamAV detections together with an IOC collection for the observed infrastructure and malware.
A server that matches these indicators should be treated as an incident, not closed after a package update. Preserve evidence, identify reachable credentials and downstream systems, rotate exposed secrets from a trusted environment and rebuild where kernel integrity cannot be established.
AI changed the throughput, not the fundamentals
UAT-10147 did not make patch management obsolete. It made long-lived exposure more expensive.
The group still needed reachable services, exploitable weaknesses, useful privileges and a route to persistence. Those are familiar defensive problems. AI helped convert them into a documented sequence that could be tested, repeated and applied across a large queue.
That changes the economics of opportunistic intrusion. An attacker with modest expertise can attempt more targets, diagnose more failures and preserve more operational knowledge. Defenders cannot assume that older vulnerabilities will be ignored because exploiting them once required too much manual work.
The durable response is not to buy another AI label. It is to shorten the lifetime of exposed vulnerabilities, restrict the privileges available after application compromise, monitor trusted-driver and kernel activity, preserve off-host evidence and design recovery for the moment an endpoint can no longer report truthfully about itself.
The vulnerabilities were old. The operational system around them was new.
Sources and further reading
- Cisco Talos: UAT-10147 integrates agentic AI into post-compromise operations, published 20 August 2026 at 06:00 as displayed
- Cisco Talos: UAT-10147 deploys SPECTRE with Linux rootkit and vulnerable-driver capabilities, published 20 August 2026 at 06:00 as displayed
- Cisco Talos: public indicators-of-compromise repository
