AI-Driven UAT-10147 Targets Global Web Servers With SPECTRE Linux Rootkit and EDR Evasion
Researchers describe UAT-10147, a Chinese-speaking group targeting Windows and Linux web servers globally, using AI-assisted tooling to automate exploits and post-exploitation workflows for SEO fraud and data theft. The operation delivers multiple implants, including SPECTRE with a Linux kernel rootkit and EDR-bypass techniques, plus Windows payloads like BadIIS and Quasar RAT, and uses cloud-based exfiltration to blend traffic with legitimate SaaS activity. Victims span education, media, tech, and gaming sectors with the U.S., India, U.K., Germany, and the Netherlands among the top targets.