Malware

Specter

Indicators of Compromise 7

Domain vn[.]xyz Filename C:\Windows\System32\drivers\etc\hosts:cache Filename acpi_pad.ko Filename demo.pdb Filename service.pdb GitHub Repo widestring-1.2.1 Registry User index.crates.io-1949cf8c6b5b557f

MITRE ATT&CK TTPs 14

Process Injection

Defense Evasion

Thread Execution Hijacking

Defense Evasion

Exploitation for Privilege Escalation

Privilege Escalation

Defense Evasion

System Information Discovery

Command And Control

Ingress Tool Transfer

Command And Control

Credential Access

Access Token Manipulation

Defense Evasion

Exploitation for Client Execution

Exploitation of Remote Services

Lateral Movement

Exploitation for Defense Evasion

Defense Evasion

System Binary Proxy Execution

Defense Evasion

File and Directory Permissions Modification

Defense Evasion

Source Articles

UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

UAT-10147, a Chinese-speaking threat actor, is deploying a new cross-platform backdoor named SPECTRE that targets both Windows and Linux systems. The implant includes advanced capabilities such as process injection, credential theft, anti-analysis routines, and EDR evasion via Bring Your Own Vulnerable Driver (BYOVD) techniques. On Linux, SPECTRE deploys a kernel rootkit called Specter, disguised as 'acpi_pad.ko', which uses ftrace-based hooking to hide processes, modules, and enable UID 0 escalation. The actor also leverages SEO fraud tools like BadIIS and a custom ASHX web handler targeting Vietnamese users, along with multiple backdoors including Meterpreter, Noodle RAT, QuasarRAT, and Gh0stCringe for persistence.