UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

Back Thehackernews

UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

Thehackernews •[email protected] (The Hacker News) • August 24, 2026

Share: View original

AI can find and chain vulnerabilities in minutes. This session gives you a practical roadmap to strengthen visibility, response, and remediation.

AI is helping teams ship code 10–50× faster. This session shows how to keep security from falling behind.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

UAT-10147 Threat Actor Deploys SPECTRE Backdoor with AI and EDR Bypass Techniques UAT-10147, a Chinese-speaking threat actor, has been identified using the SPECTRE backdoor and a Linux rootkit to conduct sophisticated multi-platform attacks. The group employs advanced techniques such as Bring Your Own Vulnerable Driver (BYOVD) to disable endpoint detection and response (EDR) protections. Cisco Talos has analyzed the malware, revealing AI-assisted code generation and specific command structures for evasion. Organizations with internet-facing IIS and Linux servers are particularly at risk, especially if they utilize known vulnerable drivers like RTCore64.sys. Immediate isolation of compromised systems is advised to prevent lateral movement. Forensic analysis should focus on kernel integrity and unauthorized service installations. The threat actor's toolkit also includes SEO fraud tools, indicating a broader scope of impact beyond just data theft. 2 sources 73

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

T1562.001 - Disable Or Modify Tools

Platforms (1)

Vulnerabilities (1)