CVE

CVE-2021-3156

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

Exploitation IoCs 13

Domain adminapi[.]tippusoni[.]in

Filename back.bat

Filename back.txt

Filename bai.bat

Filename check_paths.py

Filename deploy_implant.py

Filename dll.zip

Filename prcc1.rar

Filename sss.ashx

Filename svchosts.exe

Filename up.ashx

Filename user.bat

IP 139[.]180[.]197[.]150

Source Articles

UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations

Cisco Talos identified a Chinese-speaking threat actor, UAT-10147, conducting a global campaign targeting Windows and Linux web servers in government, education, media, technology, and gaming sectors. The actor leverages publicly disclosed vulnerabilities for initial access, including CVE-2022-27925, CVE-2021-23758, and CVE-2019-18935, and uses AI-driven tooling to automate exploitation, reconnaissance, payload generation, and validation. Post-compromise, the actor deploys malware such as QuasarRAT, Gh0stCringe, and SPECTRE, establishes persistence via scheduled tasks and rogue user accounts, and uses AI-generated scripts to refine attacks and bypass defenses. A misconfigured command-and-control server at 139.180.197[.]150 exposed operational details, including a target list of 170,000 URLs and AI-assisted attack workflows.

talos Aug 20, 2026