talos · Crawled Sep 6, 2026

UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations

14 IoCs 2 Malware 8 CVEs
Read original article ↗

AI Summary

Cisco Talos identified a Chinese-speaking threat actor, UAT-10147, conducting a global campaign targeting Windows and Linux web servers in government, education, media, technology, and gaming sectors. The actor leverages publicly disclosed vulnerabilities for initial access, including CVE-2022-27925, CVE-2021-23758, and CVE-2019-18935, and uses AI-driven tooling to automate exploitation, reconnaissance, payload generation, and validation. Post-compromise, the actor deploys malware such as QuasarRAT, Gh0stCringe, and SPECTRE, establishes persistence via scheduled tasks and rogue user accounts, and uses AI-generated scripts to refine attacks and bypass defenses. A misconfigured command-and-control server at 139.180.197[.]150 exposed operational details, including a target list of 170,000 URLs and AI-assisted attack workflows.

AI-extracted · verify before operational use

Extracted Entities 10 found

Malware IISpy → Malware Quasar RAT → CVE CVE-2022-0995 → CVE CVE-2021-3156 → CVE CVE-2015-3246 → CVE CVE-2022-0847 → CVE CVE-2022-27925 → CVE CVE-2021-23758 → CVE CVE-2021-29441 → CVE CVE-2021-29442 →

Indicators of Compromise 14 extracted

Type Value Detail
IP 139[.]180[.]197[.]150 Details →
Domain adminapi[.]tippusoni[.]in Details →
Filename back.txt Details →
Filename back.bat Details →
Filename bai.bat Details →
Filename user.bat Details →
Filename prcc1.rar Details →
Filename svchosts.exe Details →
Filename dll.zip Details →
Filename up.ashx Details →
Filename sss.ashx Details →
Filename check_paths.py Details →
Filename deploy_implant.py Details →
Filename deploy_shell.py Details →

MITRE ATT&CK TTPs 49 techniques

T1055 Process Injection · Defense Evasion T1055.003 Thread Execution Hijacking · Defense Evasion T1059.001 PowerShell · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1090 Proxy · Command And Control T1105 Ingress Tool Transfer · Command And Control T1110 Brute Force · Credential Access T1134 Access Token Manipulation · Defense Evasion T1203 Exploitation for Client Execution · Execution T1210 Exploitation of Remote Services · Lateral Movement T1211 Exploitation for Defense Evasion · Defense Evasion T1218 System Binary Proxy Execution · Defense Evasion T1222 File and Directory Permissions Modification · Defense Evasion T1071.001 Web Protocols · Command And Control T1074 Data Staged · Collection T1112 Modify Registry · Defense Evasion T1129 Shared Modules · Execution T1137 Office Application Startup · Persistence T1140 Deobfuscate/Decode Files or Information · Defense Evasion T1176 Browser Extensions · Persistence T1190 Exploit Public-Facing Application · Initial Access T1197 BITS Jobs · Defense Evasion T1204.002 Malicious File · Execution T1218.011 Rundll32 · Defense Evasion T1484.001 Group Policy Modification · Defense Evasion T1497.001 System Checks · Defense Evasion T1547.001 Registry Run Keys / Startup Folder · Persistence T1553.005 Mark-of-the-Web Bypass · Defense Evasion T1566 Phishing · Initial Access T1570 Lateral Tool Transfer · Lateral Movement T1571 Non-Standard Port · Command And Control T1573 Encrypted Channel · Command And Control T1574.002 DLL Side-Loading · Persistence T1583 Acquire Infrastructure · Resource Development T1584 Compromise Infrastructure · Resource Development T1586 Compromise Accounts · Resource Development T1595.002 Vulnerability Scanning · Reconnaissance T1021 Remote Services · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1053.003 Cron · Execution T1059.003 Windows Command Shell · Execution T1071 Application Layer Protocol · Command And Control T1075 T1075 T1083 File and Directory Discovery · Discovery T1133 External Remote Services · Persistence T1485 Data Destruction · Impact T1490 Inhibit System Recovery · Impact