UAT-10147 is a Chinese-speaking cybercrime group that Cisco Talos linked to a global campaign against Windows and Linux web servers. The actor runs AI-assisted cyberattacks to scale exploitation, then deploys a newly identified backdoor called SPECTRE that bypasses EDR tools and installs a Linux rootkit for lasting control.<\/p>\n
Cisco Talos published its findings on August 20, 2026. The Hacker News covered the disclosure four days later, on August 24, 2026. UAT-10147 targets organizations in government, education, media, technology, and gaming, with the heaviest concentration of exposed servers in Brazil, Bolivia, China, Canada, and Vietnam.<\/p>\n
The campaign matters because it moves past opportunistic website compromise. SPECTRE backdoor deployment, EDR<\/a> bypass malware techniques, and a dedicated Linux rootkit turn a single web server exploitation event into long-term, kernel-level control of the host.<\/p>\n