Talos finds a commodity crew running agentic AI, and a target list of 170,000 URLs

Cisco Talos has published details on UAT-10147, a Chinese-speaking, financially motivated crew hitting internet-facing Windows and Linux web servers worldwide and folding AI tooling into the work once it has code execution ^[1][2]. The point is not the malware, which is ordinary; it is that Talos assesses AI-generated exploitation guidance, automation and validation workflows let this group run post-compromise operations that would traditionally require expertise its operators do not have ^[3][4].

Talos discovered the group in early 2026 and describes its business plainly: SEO fraud and data theft ^[5]. Victims sit in government, universities, media, technology and gaming ^[1], with compromised servers observed in Brazil, Bolivia, China, Canada and Vietnam ^[6]. Initial access is unremarkable, which is the part defenders control: publicly disclosed vulnerabilities, exploited at scale ^[2].

The group's own infrastructure is the more instructive find. Talos noticed a compromised machine talking to a download server at 139.180.197[.]150 and found an open directory on it ^[7]. Inside was a text file holding roughly 170,000 target URLs, which the actor had split into 17 files of about 10,000 each because scanning the whole list at once was inefficient, using the letter "w" as shorthand for the Chinese character meaning 10,000 ^[8][9]. Seventeen files of ten thousand is the entire list, so this is a queue management decision, not a sample ^[10].

The toolkit is off the shelf: Metasploit, ysoserial, PentestGPT, DeepAudit and several privilege escalation exploits ^[11]. On Windows, after remote code execution or an implant, a batch script commonly named "back.txt" or "back.bat" uses certutil to pull down the EfsPotato privilege escalation tool renamed as "prcc1.rar", a secondary script "bai.bat", and a QuasarRAT payload ^[12]. Where the actor prefers hands on keyboard, a web shell goes in first and BadIIS is set up manually, with persistence through an additional backdoor ^[13].

Talos assesses with moderate-to-high confidence that UAT-10147 belongs to an emerging class of financially motivated intrusion operators using agentic AI to operationalise offensive tradecraft at scale ^[14]. The behaviours it cites are specific rather than atmospheric: iterative exploit refinement, adaptive troubleshooting, post-exploitation automation, exploit validation workflows and generation of operational documentation ^[15]. Talos calls that a transition from AI-assisted scripting toward semi-autonomous offensive orchestration ^[16], and reports observing AI-generated operational playbooks, exploit automation scripts and troubleshooting logic supporting real intrusions ^[3].

Read against the operational picture, the consequence is a tempo problem. The skill gap between a crew that mass-scans 170,000 URLs ^[8] and a crew that can pivot, escalate and persist reliably is what has historically kept most opportunistic compromises shallow. Talos's assessment is that the gap is narrowing because the hard parts are being written, debugged and documented by tooling rather than by the operator ^[4]. If that holds, the value of an unpatched internet-facing web server to a low-skill group goes up, and the window between disclosure and exploitation stops being a buffer.

Watch for whether Talos or other vendors publish the AI-generated playbook artifacts themselves, since documentation and troubleshooting logs are the clearest evidence of how much of this workflow is actually autonomous ^[3][16]. Watch the BadIIS side, which is the revenue mechanism and the most likely place a victim notices anything ^[13]. And watch the country distribution in that 170,000-URL list against your own exposed estate, because the intake queue is the operation's roadmap and it is already public in outline ^[8][9].