UAT-10147 is a Chinese-speaking threat actor operating a sophisticated multi-platform post-exploitation ecosystem. Its toolkit includes the SPECTRE cross-platform backdoor, the Specter Linux rootkit, and SEO fraud tools such as BadIIS. The actor also uses advanced techniques including Bring Your Own Vulnerable Driver (BYOVD) to disable EDR protections and incorporates AI-assisted development workflows.
Cisco Talos analyzed recovered source code and malware samples to trace the evolution of UAT-10147’s tooling. The investigation identified signs of AI-assisted code generation within the Linux rootkit and distinctive development artifacts in the BadIIS malware. Researchers also documented the SPECTRE implant’s command structures, injection techniques, and kernel-level defense evasion capabilities.
Organizations should harden internet-facing IIS and Linux servers and monitor for deployment of known vulnerable drivers such as RTCore64.sys and DBUtil_2_3.sys . Strong EDR configurations should be enforced, with monitoring for unauthorized kernel module loading and suspicious systemd service creation. Web server defenses should also include auditing for unauthorized ASHX handlers and unexpected HTTP headers such as X-ID .
If UAT-10147 activity is detected, compromised IIS or Linux servers should be isolated immediately to limit lateral movement. Responders should conduct forensic analysis of kernel integrity and for unauthorized NTFS Alternate Data Streams. System logs should also be reviewed for suspicious service installations and potential credential theft through registry hive dumping or credential manager enumeration.
Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
Attack Narrative & Commands: The adversary has gained initial access via a web vulnerability. To establish deep persistence and evade detection, they intend to deploy a rootkit. The attacker first spawns a shell to stabilize their session. They then run ps to see if any security monitoring processes are running. Finally, they use insmod to load a dummy kernel module, mimicking the SPECTRE variant’s method of altering kernel behavior for remote control.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
