A Chinese-speaking cybercrime group designated UAT-10147 has begun deploying artificial intelligence tools to automate and scale attacks against Windows and Linux web servers across multiple continents. Security researchers confirmed the group targets education, media, technology, and gaming organisations in Brazil, Bolivia, China, Canada, and Vietnam.
UAT-10147 operators leverage AI to identify and compromise vulnerable servers, then deploy SPECTRE malware paired with custom endpoint detection and response (EDR) bypass techniques. The group also deploys Linux rootkits to establish persistent access on compromised systems. This combination of automated reconnaissance, advanced payload delivery, and evasion capabilities allows the attackers to operate at scale with minimal manual intervention.
The SPECTRE malware component serves as the group's primary backdoor. Once installed, it enables remote code execution and lateral movement within victim networks. EDR bypass mechanisms allow SPECTRE to operate undetected by security monitoring solutions that organisations typically rely on to catch post-compromise activity. The Linux rootkit deployment targets systems running web server software, giving attackers kernel-level persistence that survives system reboots and standard malware removal attempts.
Researchers traced UAT-10147 activity across multiple attack waves spanning recent months. The group's targeting of education institutions alongside commercial entities suggests a dual motivation: either direct financial gain through extortion or espionage objectives. The heavy concentration of victims in Brazil and Vietnam, combined with the group's Chinese-language operational infrastructure, indicates possible geopolitical targeting motives beyond pure financial cybercrime.
The use of AI-driven attack tools marks an escalation in the operational sophistication of Chinese-speaking threat actors. Rather than relying exclusively on manual reconnaissance and payload delivery, UAT-10147 automates vulnerability scanning and initial compromise chains. This reduces operator workload while increasing attack velocity and success rates. Organisations running unpatched or misconfigured web servers face heightened risk of rapid exploitation.
The EDR bypass capability represents the most concerning element of this campaign. Many organisations invest heavily in EDR solutions expecting these tools to detect and prevent post-compromise threats. UAT-10147's success in circumventing these defences suggests the group either reverse-engineered specific EDR products or obtained exploit code through underground markets.
Web server administrators require immediate action. Patching known vulnerabilities in Apache, Nginx, and other common web server software should take priority. Network segmentation limiting server-to-server communication restricts lateral movement options if a single system falls. Log aggregation and analysis for suspicious process execution and privilege escalation attempts can catch SPECTRE activity despite EDR evasion.
Linux rootkit persistence mechanisms typically install themselves in /lib modules or modify kernel code directly. Regular integrity checking using tools like AIDE or Tripwire detects these modifications. Organisations cannot rely on EDR alone; kernel-level threat monitoring and file system integrity monitoring provide additional detection layers.
The integration of AI into UAT-10147's attack infrastructure suggests other Chinese-speaking threat groups will likely adopt similar automation tools. Organisations operating web-facing infrastructure in all regions should assume UAT-10147 and similar groups actively scan their systems. Continuous vulnerability assessment, robust patching protocols, and multi-layered detection approaches form the essential baseline for defence.