How UAT-10147 Uses Agentic AI to Attack Web Servers

Chinese cybercrime group UAT-10147 has bypassed traditional manual hacking by deploying autonomous AI agents to scan, exploit, and maintain persistence across 170,000 web servers worldwide. By combining open-source offensive frameworks like PentestGPT and DeepAudit with custom Python automation loops, UAT-10147 turns static one-day vulnerabilities into self-troubleshooting, adaptive intrusion pipelines.

What is UAT-10147? Chinese Cybercrime Group Uses AI Tools at Scale

Declarative Summary: UAT-10147 is a financially motivated, Chinese-speaking threat actor discovered by Cisco Talos in early 2026 that uses agentic AI to automate complex post-compromise activity across thousands of enterprise web servers.

Threat Actor Profile: Motivation and Infrastructure

Tracked extensively following an operational security slip on an open command-and-control (C2) directory, UAT-10147 bridges the gap between cybercrime monetization and nation-state-level tradecraft sophistication. The group primarily monetizes intrusions through BadIIS—a specialized malware family that hijacks web server search engine indexing to run illicit SEO redirect schemes—and high-volume exfiltration of sensitive enterprise data.

The scale of UAT-10147’s operation relies on automated targeting lists. Threat researchers uncovered target text files formatted with the character “w” (representing the Chinese character “萬” or 10,000) to partition mass scanning into high-efficiency operational batches.

Key Targeted Vulnerabilities (Zimbra, Nacos, ASP.NET)

UAT-10147 focuses initial compromise operations on internet-facing Windows IIS and Linux web servers running unpatched software:

• ASP.NET ViewState Deserialization: Exploiting compromised or default MachineKeys to inject remote code directly into IIS application pools.

• Nacos & Zimbra Collaboration Platforms: Executing unauthenticated remote code execution (RCE) flaws to establish initial footholds.

• Telerik UI & AjaxPro Frameworks: Targeting legacy web components to execute deserialization payloads.

Anatomy of an Agentic AI Cyber Attack

Declarative Summary: UAT-10147 operationalizes agentic AI by creating autonomous execution loops that capture system error outputs, analyze technical failure conditions, and dynamically adjust exploit payloads until code execution succeeds.

                       ┌────────────────────────────────────────┐
                       │   Initial Exploit Payload Dispatched   │
                       └───────────────────┬────────────────────┘
                                           │
                                           ▼
                       ┌────────────────────────────────────────┐
                       │     Server Returns Error (HTTP 500)    │
                       └───────────────────┬────────────────────┘
                                           │
                                           ▼
  ┌──────────────────────────────────────────────────────────────────────────────────┐
  │                        Agentic AI Feedback & Tuning Loop                         │
  │                                                                                  │
  │  1. Agent captures HTTP output (e.g., "MAC Validation Failure").                 │
  │  2. PentestGPT / DeepAudit models parse failure logic.                           │
  │  3. Script auto-reconfigures MachineKey parameters to trigger "InvalidCast".    │
  │  4. Re-sends optimized payload dynamically without manual human intervention.    │
  └────────────────────────────────────────┬─────────────────────────────────────────┘
                                           │
                                           ▼
                       ┌────────────────────────────────────────┐
                       │   Successful Execution & Shell Access   │
                       └────────────────────────────────────────┘

Closed-Loop Payload Refinement (PentestGPT & DeepAudit)

Traditional offensive scripting relies on static, pre-written attack routines that break when encountering unexpected target environments. UAT-10147 overcomes this by integrating LLM-backed penetration testing agents—specifically PentestGPT and DeepAudit—directly into operational Python execution loops.

When targeting ASP.NET ViewState, for instance, the AI agent sends a deliberately malformed payload and reads the resulting HTTP 500 error code:

1. If the server returns a MAC Validation Failure, the agent identifies that the key signature was rejected and tests alternative validation key candidates.

2. If the server returns an InvalidCastException, the agent confirms that key deserialization succeeded and that the host is fully vulnerable, immediately signaling the secondary stage downloader.

This dynamic error handling allows lower-tier threat actors to execute complex, multi-stage post-exploitation sequences that previously required hand-crafted exploit manipulation.

Automated Reconnaissance and Web Shell Injection

Once initial access is confirmed, AI-generated Python scripts perform rapid automated triage:

• Identifying writable directories across Windows IIS (C:\inetpub\wwwroot) and Linux (/var/www/html) paths.

• Generating custom, obfuscated in-memory web shells that blend with legitimate server traffic via specialized HTTP headers (e.g., X-ID and X-seo).

• Using asynchronous out-of-band channels—such as polling rogue adversary-controlled Nacos instances—to track victim status without establishing loud, direct reverse shells.

Malware Analysis: SPECTRE Backdoor and BadIIS Architecture

Declarative Summary: UAT-10147 deploys a custom, dual-platform threat framework highlighted by SPECTRE (a feature-rich backdoor utilizing EDR-killing driver abuse) and BadIIS (an IIS-native SEO fraud module).

Windows Evasion: BYOVD Tactics and Defender Tampering

The Windows variant of SPECTRE achieves high persistence through anti-analysis and defense evasion tactics:

• PEB Hash Walking & Dynamic API Resolution: Rather than importing Windows APIs directly (which alerts static scanners), SPECTRE resolves API addresses at runtime by parsing the Process Environment Block (PEB) using a custom DJB2 hashing algorithm.

• Compile-Time Literal Encryption: Every sensitive string inside the binary is encrypted at compile time using a 32-bit PRNG seed. Decryption occurs exclusively in thread-local memory immediately prior to execution.

• BYOVD EDR Disablement: SPECTRE abuses signed, vulnerable drivers—such as RTCore64.sys (Micro-Star International) and DBUtil_2_3.sys (Dell)—to grant the malware arbitrary kernel read/write privileges, allowing it to unhook or terminate running EDR agents directly.

• Antivirus Exclusion Injection: Automated post-exploitation scripts leverage tools like EfsPotato to gain NT AUTHORITY\SYSTEM privileges, immediately adding critical system directories (%SystemRoot%\System32\inetsrv) into Microsoft Defender exclusion lists via PowerShell.

Linux Persistence: Kernel Rootkit (acpi_pad.ko)

On Linux environments, UAT-10147 leverages local privilege escalation exploits like Dirty Pipe (CVE-2022-0847) and Baron Samedit (CVE-2021-3156) to achieve root access. The adversary then installs a kernel rootkit compiled under the deceptive name acpi_pad.ko (mimicking the legitimate ACPI power management driver). This rootkit hides malicious processes, network sockets, and file structures from standard system monitoring utilities like netstat, ps, and ls.

SEO Fraud Monetization via BadIIS

The ultimate commercial goal for UAT-10147 in many campaigns is SEO fraud. By installing BadIIS modules into compromised web servers, the group inspects inbound HTTP user-agent strings:

• When Googlebot or Bingbot crawls the server, BadIIS dynamically injects thousands of hidden spam links promoting counterfeit goods, online gambling, or phishing destinations.

• When regular visitors access the site, the legitimate page renders normally, allowing the threat actor to monetized web reputation for months without host organization detection.

Actionable Mitigation and Enterprise Defense Strategies

Declarative Summary: Defending against UAT-10147 requires hard technical controls focused on edge application patching, ASP.NET key management, kernel driver blocking, and monitoring system exclusion lists.

System Patching and ASP.NET Key Rotation

1. Edge Application Hardening: Immediately audit internet-exposed web assets running Zimbra, Nacos, Telerik UI, and AjaxPro. Apply security updates to resolve known remote code execution vulnerabilities.

2. Rotate MachineKeys & Re-key IIS: Ensure ASP.NET MachineKey parameters are explicitly defined, encrypted, and regularly rotated. Never rely on auto-generated or default ViewState keys across server farms.

EDR Hardening, BYOVD Driver Blocking, and Registry Auditing

1. Enforce Vulnerable Driver Blocklists: Enable Microsoft Vulnerable Driver Blocklist enforcement or deploy Hypervisor-Protected Code Integrity (HVCI) to block known BYOVD exploit drivers such as RTCore64.sys and DBUtil_2_3.sys.

2. Audit Antivirus Exclusions: Establish automated SOC alerts monitoring modifications to Defender settings, specifically looking for PowerShell calls targeting web server paths:

   PowerShell

   Add-MpPreference -ExclusionPath "C:\Windows\System32\inetsrv"
   

3. Inspect Kernel Modules and ADS Files: Scan Linux hosts for unauthorized loadable kernel modules (.ko files) outside standard distribution updates. On Windows hosts, audit NTFS Alternate Data Streams (such as hosts:cache) to identify hidden C2 configuration blocks.

Frequently Asked Questions (People Also Ask)

What is UAT-10147?

UAT-10147 is a financially motivated Chinese-speaking threat actor known for using agentic AI tools to conduct mass attacks against web servers globally for SEO fraud and data theft.

How does UAT-10147 use AI in cyber attacks?

UAT-10147 uses AI tools like PentestGPT and DeepAudit to analyze error responses, automatically refine exploit parameters, generate code, and automate post-exploitation workflows.

What malware does UAT-10147 deploy?

UAT-10147 deploys the cross-platform SPECTRE backdoor, the BadIIS SEO fraud framework, and custom stealth Linux kernel rootkits (acpi_pad.ko).

What is a BYOVD attack in the context of SPECTRE malware?

A Bring Your Own Vulnerable Driver (BYOVD) attack occurs when malware drops a legitimately signed but vulnerable driver (such as RTCore64.sys) to obtain kernel-level access and turn off security software.

How can organizations defend against UAT-10147?

Organizations should patch web applications (Zimbra, Nacos, Telerik), rotate ASP.NET MachineKeys, enable driver blocklists, and audit Defender exclusion paths.