UAT-10147 Leverages AI and Kernel Rootkits to Automate Global Server Intrusions
Cisco Talos identified a Chinese-speaking cybercrime group, UAT-10147, that uses AI-driven tools to automate attacks on 170,000 global web servers. The group deploys a new cross-platform backdoor, SPECTRE, which includes a Linux kernel rootkit and bypasses endpoint detection systems. Targets include government, education, and tech sectors in Brazil, Canada, and Vietnam, with the actor leveraging AI for exploit refinement, validation, and post-compromise automation.