Chinese Hackers Automate Web Server Exploits Using AI Agents
A Chinese-speaking threat group, UAT-10147, is employing AI agents to streamline reconnaissance, exploitation, and post-compromise activities against vulnerable web servers, increasing the scale and speed of intrusions.
A Chinese-speaking cybercrime group, tracked as UAT-10147, is leveraging AI-assisted tools to automate attacks against vulnerable web servers, transforming familiar exploits into more dangerous threats. The group has targeted internet-facing Windows and Linux systems across government, education, media, technology, and gaming sectors globally. Cisco Talos identified that UAT-10147 combines publicly known exploits for products like Zimbra, AjaxPro, Nacos, and Telerik with AI-generated instructions, scripts, and validation workflows. This AI-assisted approach enables the group to conduct complex intrusions at a significantly greater scale and speed than traditional manual methods.
The AI agents are described as operational assistants, aiding in various stages of the attack lifecycle. They help in scanning websites, adapting failed exploits, validating payload success, gathering system details, and establishing backdoors with reduced manual effort. This marks a practical shift in criminal operations, where AI streamlines tasks that previously required extensive human intervention. The recovered materials suggest AI involvement across the full attack cycle, not just in code generation. For instance, AI-generated playbooks assisted in abusing ASP.NET ViewState deserialization, from checking stolen configuration keys to creating payloads and confirming execution discreetly.
Initial access for the campaign relied on publicly known remote-code-execution (RCE) vulnerabilities. On Windows systems, after gaining remote access, the operators deployed BadIIS, a malicious IIS module often associated with search-result manipulation. They also utilized scripts to escalate privileges, weaken endpoint detection around IIS folders, establish high-privilege access, and maintain persistence after the initial breach. For Linux targets, a similar pattern was observed: after deploying a web shell, the group exploited local privilege escalation bugs, such as Dirty Pipe, to achieve root access and install additional implants.
The automation extends the potential damage by allowing for rapid iteration and adaptation. The recovered scripts demonstrate AI's role in checking writable folders, mapping IIS sites, deploying implants, placing web shells, and collecting results through callbacks. If an attack fails, the AI-driven workflow can diagnose obstacles and attempt alternative methods. The group also used a cloud configuration service to collect basic victim details after exploiting Nacos, blending stolen information with routine web traffic to make initial confirmation and follow-up activities harder for defenders to detect.
Organizations are urged to treat public-facing web servers as high-priority assets. Key defensive measures include rapid patching, limiting unnecessary exposure, reviewing IIS and application configuration changes, and closely monitoring for unusual scheduled tasks, new accounts, suspicious outbound connections, and excluded security paths. Protecting ASP.NET MachineKey material and investigating unexpected server errors, rather than dismissing them, are also critical. Error responses can indicate an attacker testing deserialization access, and restricting administrative endpoints is vital to mitigate deployment vulnerability risks.
While this campaign does not signify that AI has made attacks fully independent of human operators, it highlights how financially motivated groups can use AI to repeat established techniques more efficiently. This significantly reduces the time between discovering a vulnerability and achieving a profitable intrusion. The practical lesson for defenders is to reduce the attack surface proactively before automated tooling can exploit it. Maintaining accurate asset inventories, applying security updates diligently, protecting sensitive credentials, and robustly monitoring web server behavior remain essential, especially in light of other emerging threats.