UAT-10147 Deploys SPECTRE Backdoor With EDR Bypass, Linux Rootkit

UAT-10147 is a Chinese-speaking cybercrime group that Cisco Talos linked to a global campaign against Windows and Linux web servers. The actor runs AI-assisted cyberattacks to scale exploitation, then deploys a newly identified backdoor called SPECTRE that bypasses EDR tools and installs a Linux rootkit for lasting control.

Cisco Talos published its findings on August 20, 2026. The Hacker News covered the disclosure four days later, on August 24, 2026. UAT-10147 targets organizations in government, education, media, technology, and gaming, with the heaviest concentration of exposed servers in Brazil, Bolivia, China, Canada, and Vietnam.

The campaign matters because it moves past opportunistic website compromise. SPECTRE backdoor deployment, EDR bypass malware techniques, and a dedicated Linux rootkit turn a single web server exploitation event into long-term, kernel-level control of the host.

AI as an operational multiplier, not just a scripting aid

UAT-10147 folds AI-assisted cyberattacks into nearly every phase of intrusion, not only initial exploitation:

• DeepAudit: an AI-driven vulnerability scanner Talos found staged on the actor’s management server. Talos has not observed the group exploiting flaws this tool discovered inside victim environments.
• PentestGPT: an open-source autonomous pentesting framework the group installed on its command-and-control server to scan web servers and run proof-of-concept exploits automatically.
• AI-wrapped ysoserial scripts: AI-generated Python wrapper scripts that call ysoserial, a standard open-source deserialization payload tool, to check writable paths, deploy SPECTRE through ViewState deserialization, and drop a web shell using the same flaw.
• Operational documentation: an AI-authored ASP.NET ViewState deserialization guide covering key validation, payload generation, and privilege escalation from IIS AppPool identity to SYSTEM.

Talos assesses with moderate to high confidence that UAT-10147 belongs to an emerging class of actors operationalizing agentic AI at scale, a pattern the report frames as a broader shift from AI-assisted scripting toward more autonomous offensive orchestration.

Windows Server malware chain: EfsPotato to BadIIS and SPECTRE

UAT-10147’s Windows server malware chain starts with a single web server exploitation event. From there, a scripted sequence escalates privileges, blinds Defender, and installs SPECTRE.

• The actor exploits a known vulnerability in a website or IIS server to achieve remote code execution.
• A batch script uses certutil to pull EfsPotato, a secondary batch script, and Quasar RAT from actor-controlled infrastructure.
• EfsPotato elevates privileges, and the script then adds IIS directories to the Microsoft Defender exclusion list.
• The script deletes its initial payloads afterward to slow forensic analysis.
• A secondary script silently runs Quasar RAT and sets persistence through a scheduled task disguised as “Google Chrome Start.”
• A third downloaded script installs BadIIS, and the actor deploys Gh0stCringe or the SPECTRE backdoor for extended access.

Linux Rootkit path: Root access to persistent Kernel control

On Linux, UAT-10147 pairs old privilege escalation flaws with the SPECTRE backdoor. The result is root access and a Linux rootkit that survives reboots.

• The actor exploits a known server-side flaw for initial access, then drops a web shell for interactive control.
• Six documented Linux flaws, including Dirty Pipe (CVE-2022-0847) and the sudo flaw Baron Samedit (CVE-2021-3156), hand the actor root privileges.
• Root access opens the door to Noodle RAT, Meterpreter, and SPECTRE for outbound command-and-control connections.
• SPECTRE’s Linux build loads a kernel module rootkit called Specter that hides artifacts and survives reboots.
• Both SPECTRE variants run a weighted sandbox-detection check and self-terminate if the score passes 50 points, which slows analysis in test environments.

SPECTRE backdoor capability overview

Known vulnerabilities weaponized at scale

Web server exploitation in this campaign relies entirely on publicly disclosed flaws, not zero-days:

• CVE-2022-27925 (Zimbra Collaboration Suite)
• CVE-2021-23758 (AjaxPro deserialization)
• CVE-2019-18935 (Telerik UI for ASP.NET AJAX)
• CVE-2021-29441 and CVE-2021-29442 (Alibaba Nacos)

Six Linux local privilege escalation flaws spanning 2010 to 2022, including Dirty Pipe and Baron Samedit

Detection timeline

The SPECTRE backdoor and UAT-10147’s exploitation activity span several months before public disclosure. Here is how the timeline unfolded from first use to reporting.

April 2026: Talos traces the first observed use of the SPECTRE backdoor to this month.

Through mid-2026: UAT-10147 continues exploiting web servers globally using known flaws and AI-assisted cyberattacks.

August 20, 2026: Cisco Talos publishes its two-part disclosure covering UAT-10147 and the SPECTRE implant.

August 24, 2026: The Hacker News reports on the disclosure, four days after Talos’s original publication.

What Security Teams Should Verify Now

UAT-10147’s chain relies on specific, checkable indicators rather than a single silver-bullet fix. Security teams should verify the following areas immediately.

• Patch the six Linux privilege escalation flaws named above on any exposed server still running older kernels or utilities.
• Patch Zimbra, AjaxPro, Telerik UI for ASP.NET AJAX, and Alibaba Nacos instances still exposed to the listed CVEs.
• Hunt for scheduled tasks named “Google Chrome Start” and unexpected Windows Defender exclusion paths under IIS directories.
• Check kernel driver load events for MSI’s RTCore64.sys (CVE-2019-16098) and Dell’s DBUtil_2_3.sys (CVE-2021-21551), the two drivers behind this BYOVD attack.
• Enable the Microsoft Vulnerable Driver Blocklist, or block the hashes for RTCore64.sys and DBUtil_2_3.sys directly, to proactively close this BYOVD vector.
• Review outbound traffic to Nacos-style configuration management endpoints for signs of blended exfiltration.
• Inspect Linux hosts for unexpected kernel modules that could indicate rootkit persistence.

Strengthening XDR Detection and UEM Patch Management Against UAT-10147

Hexnode XDR and Hexnode UEM address different parts of this exposure. Both complement, rather than replace, vendor patching and application-specific investigation.

• Hexnode XDR currently detects BYOVD-driven driver loads, process injection, and kernel callback tampering on Windows and macOS endpoints.
• Hexnode UEM enforces OS and application patch compliance across Windows and macOS, with extended Linux support, deploys baseline security configuration profiles across Windows, macOS, iOS, and Android, and reports device compliance to Microsoft Entra ID for Android, iOS, and macOS.

Hexnode does not detect the specific CVEs named above or patch third-party applications like Zimbra, Nacos, or Telerik. Vendor patching and web server hardening remain the primary remediation path.

Conclusion

UAT-10147 shows how AI-assisted cyberattacks let a mid-tier cybercrime group scale old vulnerabilities into full server compromise. Known flaws, not zero-days, still open the door to Windows server malware chains and Linux rootkit deployments alike.

Security teams should prioritize patching the specific CVEs UAT-10147 weaponizes, hunt for SPECTRE’s BYOVD attack indicators, and pair XDR detection with UEM patch management to close exposure before EDR bypass malware and rootkit persistence take hold.