Full Report
Cybersecurity researchers have disclosed details of a Chinese-speaking cybercrime group dubbed UAT-10147 that's targeting Windows and Linux web servers globally across the education, media, technology, and gaming sectors. The vast majority of the targets are located in Brazil, Bolivia, China, Canada, and Vietnam. Details of the threat activity came to light following the discovery of an open
Analysis Summary
# Threat Actor: UAT-10147
## Attribution & Identity
* **Actor Identification:** UAT-10147 is a Chinese-speaking cybercrime group.
* **Aliases/Associations:** The group shares infrastructure and specific malware variants (BadIIS) typically associated with a Chinese Malware-as-a-Service (MaaS) model. It utilizes cross-platform tools often linked to other Chinese-speaking actors, such as Noodle RAT and Gh0st RAT variants.
## Activity Summary
* **Recent Campaigns:** A global campaign targeting Windows and Linux web servers, characterized by the use of AI to scale operations. The activity was identified via an open directory (139.180.197[.]150) containing a target list of approximately 170,000 URLs.
* **Historical Context:** The group is noted for integrating AI-powered tools (e.g., PentestGPT, DeepAudit) into their post-compromise operations to automate reconnaissance, payload generation, and troubleshooting at a scale previously difficult for manual operators.
## Tactics, Techniques & Procedures
* **Initial Access:** Exploitation of publicly disclosed vulnerabilities (N-day) to achieve Remote Code Execution (RCE) on IIS and web servers at scale.
* **AI-Enhanced Operations:** Leveraging AI to refine exploits, troubleshoot logic, automate post-exploitation workflows, and generate operational documentation.
* **Privilege Escalation:** Use of "EfsPotato" and various LPE exploits for Windows and Linux to gain SYSTEM/Root access.
* **Persistence:** Establishing deceptive scheduled tasks (e.g., "Google Chrome Start") and deploying web shells or BadIIS backdoors.
* **Defense Evasion:** Configuring Microsoft Windows Defender exclusions, deleting initial payloads, and using cross-platform implants to bypass EDR.
* **MITRE ATT&CK IDs:**
* T1190 (Exploit Public-Facing Application)
* T1059 (Command and Scripting Interpreter)
* T1068 (Exploitation for Privilege Escalation)
* T1053.005 (Scheduled Task/Job: Scheduled Task)
* T1562.001 (Impair Defenses: Disable or Modify Tools)
* T1505.003 (Server Software Component: Web Shell)
## Targeting
* **Sectors:** Education, Media, Technology, and Gaming.
* **Geography:** Primarily Brazil, Bolivia, China, Canada, and Vietnam. The broader target list includes the U.S., India, U.K., Germany, and the Netherlands.
* **Victims:** Global Windows and Linux-based web servers.
## Tools & Infrastructure
* **Malware Families:**
* **SPECTRE:** A previously unreported cross-platform implant.
* **BadIIS:** A specialized IIS backdoor used for SEO fraud and data theft.
* **RATs:** Quasar RAT, Gh0stCringe, Noodle RAT (Gh0st/Rekoobe variant), and Meterpreter.
* **Offensive Frameworks:** Metasploit, ysoserial, PentestGPT, DeepAudit.
* **Infrastructure:**
* 139.180.197[.]150 (Open directory/C2 communication)
* adminapi.tippusoni[.]in (Payload delivery)
## Implications
The integration of agentic AI into the attack lifecycle represents a significant shift in threat actor capabilities. UAT-10147 demonstrates that even lower-tier cybercrime groups can now execute high-volume, sophisticated campaigns by using AI to handle the "heavy lifting" of troubleshooting and exploit validation, allowing them to compromise tens of thousands of servers simultaneously.
## Mitigations
* **Patch Management:** Prioritize patching known RCE and LPE vulnerabilities, specifically CVE-2022-0995, CVE-2021-3156, and CVE-2022-0847 (Dirty Pipe).
* **EDR/XDR Monitoring:** Monitor for unauthorized use of `certutil` for file downloads and suspicious scheduled tasks mimicking legitimate software (e.g., Chrome).
* **IIS Security:** Audit IIS servers for unauthorized modules or web shells; restrict permissions to prevent tools like EfsPotato from gaining SYSTEM access.
* **Network Defense:** Block known C2 domains and monitor for outbound connections from web servers to unusual IP addresses.