CVE

CVE-2021-29442

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so thi

Exploitation IoCs 13

Domain adminapi[.]tippusoni[.]in

Filename back.bat

Filename back.txt

Filename bai.bat

Filename check_paths.py

Filename deploy_implant.py

Filename dll.zip

Filename prcc1.rar

Filename sss.ashx

Filename svchosts.exe

Filename up.ashx

Filename user.bat

IP 139[.]180[.]197[.]150

Source Articles

UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations

Cisco Talos identified a Chinese-speaking threat actor, UAT-10147, conducting a global campaign targeting Windows and Linux web servers in government, education, media, technology, and gaming sectors. The actor leverages publicly disclosed vulnerabilities for initial access, including CVE-2022-27925, CVE-2021-23758, and CVE-2019-18935, and uses AI-driven tooling to automate exploitation, reconnaissance, payload generation, and validation. Post-compromise, the actor deploys malware such as QuasarRAT, Gh0stCringe, and SPECTRE, establishes persistence via scheduled tasks and rogue user accounts, and uses AI-generated scripts to refine attacks and bypass defenses. A misconfigured command-and-control server at 139.180.197[.]150 exposed operational details, including a target list of 170,000 URLs and AI-assisted attack workflows.

talos Aug 20, 2026