talos · Crawled Sep 1, 2026

UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

7 IoCs 4 Malware
Read original article ↗

AI Summary

UAT-10147, a Chinese-speaking threat actor, is deploying a new cross-platform backdoor named SPECTRE that targets both Windows and Linux systems. The implant includes advanced capabilities such as process injection, credential theft, anti-analysis routines, and EDR evasion via Bring Your Own Vulnerable Driver (BYOVD) techniques. On Linux, SPECTRE deploys a kernel rootkit called Specter, disguised as 'acpi_pad.ko', which uses ftrace-based hooking to hide processes, modules, and enable UID 0 escalation. The actor also leverages SEO fraud tools like BadIIS and a custom ASHX web handler targeting Vietnamese users, along with multiple backdoors including Meterpreter, Noodle RAT, QuasarRAT, and Gh0stCringe for persistence.

AI-extracted · verify before operational use

Extracted Entities 4 found

Malware Specter → Malware IISpy → Malware JuicyPotato → Malware Quasar RAT →

Indicators of Compromise 7 extracted

Type Value Detail
Domain vn[.]xyz Details →
Filename acpi_pad.ko Details →
Filename service.pdb Details →
Filename demo.pdb Details →
Filename C:\Windows\System32\drivers\etc\hosts:cache Details →
Registry User index.crates.io-1949cf8c6b5b557f Details →
GitHub Repo widestring-1.2.1 Details →

MITRE ATT&CK TTPs 43 techniques

T1055 Process Injection · Defense Evasion T1055.003 Thread Execution Hijacking · Defense Evasion T1068 Exploitation for Privilege Escalation · Privilege Escalation T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1090 Proxy · Command And Control T1105 Ingress Tool Transfer · Command And Control T1110 Brute Force · Credential Access T1134 Access Token Manipulation · Defense Evasion T1203 Exploitation for Client Execution · Execution T1210 Exploitation of Remote Services · Lateral Movement T1211 Exploitation for Defense Evasion · Defense Evasion T1218 System Binary Proxy Execution · Defense Evasion T1222 File and Directory Permissions Modification · Defense Evasion T1059.001 PowerShell · Execution T1003 OS Credential Dumping · Credential Access T1021 Remote Services · Lateral Movement T1071.001 Web Protocols · Command And Control T1074 Data Staged · Collection T1212 Exploitation for Credential Access · Credential Access T1485 Data Destruction · Impact T1112 Modify Registry · Defense Evasion T1129 Shared Modules · Execution T1137 Office Application Startup · Persistence T1140 Deobfuscate/Decode Files or Information · Defense Evasion T1176 Browser Extensions · Persistence T1190 Exploit Public-Facing Application · Initial Access T1197 BITS Jobs · Defense Evasion T1204.002 Malicious File · Execution T1218.011 Rundll32 · Defense Evasion T1484.001 Group Policy Modification · Defense Evasion T1497.001 System Checks · Defense Evasion T1547.001 Registry Run Keys / Startup Folder · Persistence T1553.005 Mark-of-the-Web Bypass · Defense Evasion T1566 Phishing · Initial Access T1570 Lateral Tool Transfer · Lateral Movement T1571 Non-Standard Port · Command And Control T1573 Encrypted Channel · Command And Control T1574.002 DLL Side-Loading · Persistence T1583 Acquire Infrastructure · Resource Development T1584 Compromise Infrastructure · Resource Development T1586 Compromise Accounts · Resource Development T1595.002 Vulnerability Scanning · Reconnaissance