A sophisticated Chinese-speaking threat actor, identified as UAT-10147, is running a global server attack campaign targeting Windows and Linux systems across the education, media, technology, and gaming sectors. Primarily striking organizations in Brazil, Bolivia, China, Canada, and Vietnam, the actor is leveraging automation and AI-powered tools to scale its operations. Teams of cybersecurity analysts uncovered the scheme after discovering an exposed directory (IP 139.180.197.150) used by one of the compromised machines. ([thehackernews.com](https://thehackernews.com/2026/08/uat-10147-uses-ai-to-scale-server.html))
Exploits, Backdoors & Specialized Implants
UAT-10147 kicks off access using publicly known vulnerabilities to gain remote code execution (RCE) on vulnerable web and IIS servers. Once inside, the actor runs scripts to deploy data theft or SEO fraud implants. Web shells lead to the deployment of malware such as BadIIS and a newly observed cross-platform backdoor named SPECTRE. ([thehackernews.com](https://thehackernews.com/2026/08/uat-10147-uses-ai-to-scale-server.html))
On Windows, UAT-10147 uses a multi-stage process: first running a batch script that uses certutil to pull in a privilege escalation tool (“EfsPotato”), then installing Quasar RAT, followed by installing backdoors for long-term access. Tasks are hidden using deceptive scheduled jobs with benign names like “Google Chrome Start,” and Microsoft Defender exclusions are configured. ([thehackernews.com](https://thehackernews.com/2026/08/uat-10147-uses-ai-to-scale-server.html))
Cross-Platform Attacks & AI Support
Linux systems are attacked similarly, with initial access via known vulnerabilities and local privilege escalation exploits such as CVE-2022-0995, CVE-2021-3156, and several older ones. Once root is obtained, UAT-10147 installs rootkits and backdoors like Noodle RAT, SPECTRE, and Meterpreter. ([thehackernews.com](https://thehackernews.com/2026/08/uat-10147-uses-ai-to-scale-server.html))
A key AI tool in use is DeepAudit, a scanner that identifies vulnerabilities. While it hasn’t yet been used to exploit hosts according to investigators, it likely serves as both reconnaissance and defensive auditing. UAT-10147 also deploys PentestGPT on their command-and-control servers, using it to scan web servers and test proof-of-concept exploits. ([thehackernews.com](https://thehackernews.com/2026/08/uat-10147-uses-ai-to-scale-server.html))
One of the most dangerous elements is SPECTRE, the implant under UAT-10147’s control. Written in C, this cross-platform backdoor supports dozens of commands and includes anti-analysis measures, kernel-level endpoint detection and response (EDR) bypass, credential theft, and process injection. On Windows, it uses vulnerable drivers under a BYOVD technique to disable EDR systems like CrowdStrike, Microsoft Defender, SentinelOne, etc. On Linux, it uses a rootkit kernel module and scripted checks to evade sandboxing. ([thehackernews.com](https://thehackernews.com/2026/08/uat-10147-uses-ai-to-scale-server.html))
The operation also includes a mass URL target list, with roughly 170,000 URLs partitioned into 17 files of 10,000 links each, covering sites in the U.S., India, the U.K., Germany, and the Netherlands. Infected hosts are used for both SEO fraud manipulation and data theft. Exfiltration is often disguised through routing data via legitimate cloud-based configuration services, allowing operators to avoid detection and direct reverse-shells. ([thehackernews.com](https://thehackernews.com/2026/08/uat-10147-uses-ai-to-scale-server.html))
Another novel trick involves ASP.NET ViewState deserialization-based RCE: UAT-10147 uses leaked MachineKey values, the badsecrets library, and ysoserial.net to build payloads that evade ViewState protection. Once executed, reconnaissance script activities include collecting system/process info, running processes, network settings, etc. Persistence may be established using SPECTRE or ASHX web shells. ([thehackernews.com](https://thehackernews.com/2026/08/uat-10147-uses-ai-to-scale-server.html))
SPECTRE’s Windows version includes file ops, screenshot capture, keylogging, shell commands, process listing and killing, file uploads/downloads, reverse shells, process hollowing, Early Bird APC injection, and EDR process termination via BYOVD. The Linux variant has fewer commands but adds a kernel rootkit, anti-sandbox features, and the ability to self-terminate under certain suspicious conditions. ([thehackernews.com](https://thehackernews.com/2026/08/uat-10147-uses-ai-to-scale-server.html))
This active range of targets, use of known exploits, diverse backdoors, and AI-driven tools marks a significant leap in offensive tradecraft for groups operating at scale. ([thehackernews.com](https://thehackernews.com/2026/08/uat-10147-uses-ai-to-scale-server.html))
Understanding AI’s growing role in facilitating complex cyber-attack chains is more urgent than ever. UAT-10147 isn’t just using AI for speed or scalability—it deploys generation, validation, obfuscation, and persistence functions. Defenders need proactive posture: keep systems patched, monitor C2 indicators, closely inspect use of vulnerable drivers, and audit for known signs like unusual process injection or ViewState exploitation. The rise of tools like SPECTRE and DeepAudit may be harbingers of a future where attack automation is the norm, not the exception.
