UAT-10147 Leverages AI and Kernel Rootkits to Automate Global Server Intrusions

Key points

• UAT-10147 targets Windows and Linux servers for SEO fraud and data theft, utilizing AI to automate exploitation and troubleshooting.
• The group deploys SPECTRE, a custom C backdoor with 45 commands on Windows and 29 on Linux, featuring kernel-level evasion.
• SPECTRE uses Bring Your Own Vulnerable Driver techniques to disable EDR callbacks, blinding security products like CrowdStrike and SentinelOne.
• The Linux variant includes a kernel rootkit named Specter, disguised as a hardware monitor service, which persists across reboots.
• Talos discovered the campaign via an exposed directory containing a target list of 170,000 URLs, split into 17 files for efficient processing.

Background

This activity follows a trend of adversaries using Microsoft-signed or vulnerable drivers to blind endpoint detection, as seen in July 2026 with the GodDamn ransomware campaign. While that incident involved a specific ransomware family, UAT-10147 demonstrates a broader shift toward AI-assisted, semi-autonomous offensive orchestration across multiple sectors.

How outlets are covering it

Cisco Talos and CyberInsider emphasize the integration of agentic AI, such as PentestGPT and DeepAudit, into the attack lifecycle, marking a shift from simple scripting to autonomous workflows. The Hacker News highlights the technical specifics of the SPECTRE implant and its EDR bypass capabilities. CyberPress focuses on the use of DeepSeek AI for vulnerability exploitation, though the primary sources attribute the tooling to open-source frameworks and custom AI-generated scripts rather than a specific commercial model. All sources agree on the scale of the target list and the geographic concentration of victims.

Why it matters

The use of AI to automate complex post-compromise operations lowers the skill barrier for advanced intrusions, enabling financially motivated groups to scale attacks efficiently. The deployment of kernel-level rootkits and EDR bypass techniques renders traditional security monitoring ineffective, requiring defenders to focus on patching exposed services and monitoring for anomalous kernel modules.

What to watch

Defenders should prioritize patching known vulnerabilities in Zimbra, AjaxPro, and Nacos, rotate ASP.NET MachineKeys, and monitor for suspicious Defender exclusions or systemd services. Organizations should also investigate the presence of vulnerable drivers like MSI RTCore64.sys and Dell DBUtil_2_3.sys, which are leveraged for EDR evasion.