Chinese Actor UAT-10147 Deploys Advanced SPECTRE Implant with AI-Assisted Development
Chinese-speaking threat actor UAT-10147 is leveraging a sophisticated, cross-platform implant named SPECTRE, featuring advanced evasion techniques and potentially AI-assisted development.
Cisco Talos has detailed the operations of UAT-10147, a Chinese-speaking intrusion actor that employs a multi-platform post-exploitation ecosystem targeting both IIS and Linux servers. This actor combines search engine optimization (SEO) fraud for monetization with advanced persistence and defense evasion tactics. The newly identified SPECTRE implant represents a significant advancement in commodity intrusion tooling, offering cross-platform command-and-control (C2) capabilities, process injection, credential theft, and sophisticated endpoint detection and response (EDR) bypass through Linux rootkits and Bring Your Own Virtual Driver (BYOVD) techniques.
The actor's operational maturity is evident in its use of a diverse toolkit, including custom malware, open-source offensive tools, BYOVD-based EDR neutralization, Linux kernel rootkits, and advanced in-memory web shell deployment. Notably, analysis of recovered source code suggests that portions of the Linux rootkit development may have incorporated AI-assisted code generation, indicating the growing influence of generative AI in accelerating malware development. This follows previous Talos findings where UAT-10147 was observed using AI-assisted exploitation workflows to compromise internet-facing servers at scale.
Talos also identified several SEO fraud-related components that are likely associated with an entity known as "x Shen" (xshen), based on development artifacts found within the BadIIS malware and related tooling. These artifacts include specific PDB paths referencing "x Shen" and custom service installations. Further connections to "X." were found in the ASHX SEO engine configuration and the web shell's use of an "X-ID" HTTP header for covert authentication, blending control traffic with routine HTTP communications.
The SPECTRE backdoor, written in C, is a key component of UAT-10147's arsenal. The Windows variant distinguishes itself from standard frameworks like Havoc by integrating custom post-exploitation and defense evasion features directly into the binary. It employs a dual-layered defense strategy for obfuscation and anti-analysis: API resolution occurs at runtime via PEB hash walking using a DJB2 variant algorithm, and string encryption uses a per-string xorshift32 pseudorandom number generator (PRNG) scheme. Sensitive literals are encrypted at compile time and decrypted just before execution, making static detection methods largely ineffective.
SPECTRE includes a weighted anti-analysis scoring routine that checks for process blocklists, RAM capacity, CPU core count, disk space, sleep acceleration, and common sandbox hostnames/usernames. If the cumulative score reaches 50 points or more, the process self-terminates, further hindering analysis. A fallback C2 domain is hardcoded within the binary and can be recovered through string decryption. All C2 communications are conducted via HTTP POST requests to specific API endpoints, and one observed version attempted to read its C2 configuration from an NTFS Alternate Data Stream (ADS), allowing for easier C2 updates without needing to modify firewall blocklists.
The Linux variant of SPECTRE also incorporates advanced capabilities, including kernel-level rootkit functionality designed to bypass EDR solutions. This rootkit allows the implant to hide its processes and network connections from security monitoring tools, providing a significant advantage for maintaining persistence and evading detection on compromised Linux systems. The combination of cross-platform capabilities and deep system integration makes SPECTRE a formidable tool for UAT-10147.
The actor's apparent use of AI in developing both SPECTRE and its associated Linux rootkit is a significant trend. This suggests that threat actors are increasingly adopting AI tools to accelerate their development cycles, potentially leading to more sophisticated and rapidly evolving malware. The integration of AI-assisted development, coupled with advanced evasion techniques like BYOVD and kernel-level rootkits, positions UAT-10147 as a highly capable and evolving threat.
This new report from Cisco Talos details how UAT-10147 is integrating agentic AI into its post-compromise operations, moving beyond simple scripting assistance to iterative exploit refinement, adaptive troubleshooting, and semi-autonomous offensive orchestration. The group is observed leveraging tools like PentestGPT and DeepAudit to automate complex attacks on Windows and Linux web servers globally, targeting sectors including government, education, and media.