CVE
CVE-2022-0847
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.
Exploitation IoCs 13
Domain adminapi[.]tippusoni[.]in
Filename back.bat
Filename back.txt
Filename bai.bat
Filename check_paths.py
Filename deploy_implant.py
Filename dll.zip
Filename prcc1.rar
Filename sss.ashx
Filename svchosts.exe
Filename up.ashx
Filename user.bat
IP 139[.]180[.]197[.]150
MITRE ATT&CK TTPs 1
Source Articles
UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
Cisco Talos identified a Chinese-speaking threat actor, UAT-10147, conducting a global campaign targeting Windows and Linux web servers in government, education, media, technology, and gaming sectors. The actor leverages publicly disclosed vulnerabilities for initial access, including CVE-2022-27925, CVE-2021-23758, and CVE-2019-18935, and uses AI-driven tooling to automate exploitation, reconnaissance, payload generation, and validation. Post-compromise, the actor deploys malware such as QuasarRAT, Gh0stCringe, and SPECTRE, establishes persistence via scheduled tasks and rogue user accounts, and uses AI-generated scripts to refine attacks and bypass defenses. A misconfigured command-and-control server at 139.180.197[.]150 exposed operational details, including a target list of 170,000 URLs and AI-assisted attack workflows.
talos Aug 20, 2026
Exploits and vulnerabilities in Q2 2026
In Q2 2026, a significant increase in registered vulnerabilities was observed, driven by AI-assisted discovery tools. Multiple critical vulnerabilities were exploited in both Windows and Linux systems, including local privilege escalation flaws in the Linux kernel's caching subsystem (e.g., Dirty Frag family) and newly disclosed Windows Defender and BitLocker bypass vulnerabilities. Exploitation of AI/LLM platforms such as OpenClaw, Dify, and Open WebUI surged, with vulnerabilities enabling session compromise, unauthorized access, and message manipulation. APT groups increasingly targeted newly published and zero-day vulnerabilities, using C2 frameworks like Sliver and Metasploit for post-exploitation. The report highlights growing risks from insecure AI tooling and the need for enhanced access controls and real-time monitoring.
securelist Aug 26, 2026