Published · yesterdaySecurity3 min read
Cisco Talos says a Chinese-speaking crew paired PentestGPT and DeepAudit with Metasploit and a 170,000-URL target list to compromise web servers at scale. Every entry flaw named is years old.
Not a builder's beat, but builders have a standing stake in it.
Compiled by The WatchSomething wrong?How this is made
The interesting part of the Talos account is not the implant, it is the throughput. The AI tooling is doing clerical labour: refining exploits, troubleshooting logic, validating that an exploit actually landed, automating post-exploitation, and generating operational documentation [7]. None of that is a new capability. All of it is the part of mass exploitation that historically needed a human, which is why campaigns against internet-facing servers usually run out of operator attention long before they run out of vulnerable hosts.
The infrastructure choice fits that reading. Talos researcher Joey Chen says exfiltrated data was routed to a legitimate cloud-based configuration management service so the traffic blends with normal administrative operations [20], and describes the setup as an asynchronous exfiltration sink the operators poll to confirm exploitation across victims without maintaining reverse shells or inbound connections [21]. Pair that with a 170,000-URL list chopped into 17 files of roughly 10,000 [8], which is arithmetically exact [23], and the shape is a job queue with workers, not a person with a terminal.
Then there is the geography, which does not line up. The heaviest observed victim concentration is Brazil, Bolivia, China, Canada and Vietnam [2]. The top five destinations on the actor's own target list are the United States, India, the United Kingdom, Germany and the Netherlands [9]. Zero countries appear in both sets [24]. Anyone in the second group reading the first group as a threat profile is reading the wrong column.
On the entry side, nothing here needed research. The named weaponised flaws are in Zimbra, AjaxPro, Telerik UI for ASP.NET AJAX and Alibaba Nacos [19], with assignment years between 2019 and 2022 [26]. The Linux privilege escalation set reaches back further, from CVE-2022-0995 to CVE-2010-3904, a twelve-year span with nothing newer than 2022 [17][25]. Talos's own summary is blunt about it: publicly disclosed vulnerabilities, used to gain initial access at scale [4]. Patch latency on exposed servers is the variable the attacker is exploiting, and it is now being consumed by an automated pipeline rather than a queue of humans.
Two cautions on the detection side. On Windows, EfsPotato is used to elevate and then configure Microsoft Defender exclusions [12], and the initial payloads are deleted afterwards [13], so quiet endpoint telemetry from one of these hosts is not evidence of anything. And the BadIIS component is the same variant sold under a malware-as-a-service model and used by multiple Chinese-speaking crews [16], which means a BadIIS hit tells you which shop supplied the module, not which crew is in your server.
Finally, the thin part. The report's own framing puts an EDR bypass in SPECTRE and a Linux rootkit in the chain [22], but what is actually described in the available summary is the Defender exclusion route [12] and a spread of post-root implants including Noodle RAT, SPECTRE and Meterpreter calling out to C2 [18]. The bypass mechanism and the rootkit sit in parts of the two-part report not reproduced here [1].
Ranked by verification strength, evidence, and original report placement.
Cisco Talos published a two-part report describing a Chinese-speaking cybercrime group dubbed UAT-10147 that targets Windows and Linux web servers globally across the education, media, technology and gaming sectors.
The vast majority of the observed targets are located in Brazil, Bolivia, China, Canada and Vietnam.
The activity came to light after discovery of an open directory hosted at 139.180.197[.]150, which was seen communicating with one of the compromised machines.
Talos said: "The actor leveraged publicly disclosed vulnerabilities to gain initial access at scale."
The actor used a mixture of open-source offensive frameworks including Metasploit, ysoserial, PentestGPT, DeepAudit and multiple privilege escalation exploits to automate intrusion operations and establish persistence.
UAT-10147 conducts SEO fraud and data theft while integrating AI-powered tools at various phases of the attack cycle, including exploitation, reconnaissance, payload generation, validation and persistence.
The reporting this story was synthesized from, earliest first. Every link goes to the original.