Cisco Talos researchers have identified a Chinese-speaking cybercrime group, tracked as UAT-10147, that is integrating agentic artificial intelligence (AI) into its post-compromise operations. The group targets Windows and Linux web servers globally, affecting organizations in government, education, media, technology, and gaming sectors. This activity was first observed in early 2026.
UAT-10147 employs AI-driven tooling across various stages of their attacks, including exploitation, reconnaissance, payload generation, validation, and persistence workflows. Talos noted the use of AI-generated operational playbooks, exploit automation scripts, and troubleshooting logic in real-world intrusions. This indicates a shift from AI-assisted scripting to more semi-autonomous offensive orchestration, enabling the group to scale complex attacks more efficiently and reduce the need for specialized expertise.
The group leverages publicly disclosed vulnerabilities for initial access and utilizes a mix of open-source offensive frameworks such as Metasploit, ysoserial, PentestGPT, and DeepAudit. They also employ multiple privilege escalation exploits to automate intrusion operations and establish persistence. Talos assesses with moderate-to-high confidence that UAT-10147 is among an emerging class of financially motivated operators using agentic AI systems to operationalize offensive tradecraft at scale.
Victims include high-value internet-exposed web servers in countries such as Brazil, Bolivia, China, Canada, and Vietnam. Talos’ investigation revealed a target list of approximately 170,000 URLs, which the attackers split into 17 files of 10,000 URLs each, using the letter "w" as a reference to the Chinese character "萬" (ten thousand) to denote these segments.
The group's operational security (OPSEC) failure led to the discovery of their activities. Talos observed a compromised machine communicating with a download server at 139.180.197[.]150, which had an open directory listing, exposing various files and tools used in their operations.
Upon gaining initial access, typically through remote code execution (RCE) on a web server, UAT-10147 often runs an automated script to deploy malware for search engine optimization (SEO) fraud or data theft. In some cases, they install a web shell to manually set up the BadIIS malware and establish persistence.
On Windows systems, the attack chain involves multi-stage batch scripts, commonly named "back.txt" or "back.bat." These scripts use `certutil` to download a privilege escalation tool (EfsPotato, renamed "prcc1.rar"), a secondary batch script ("bai.bat"), and the QuasarRAT payload (disguised as "svchosts.exe"). EfsPotato is used to gain elevated privileges, modify the Windows Registry, and add specific directories to Windows Defender's exclusion list via PowerShell, thereby evading antivirus detection. The scripts also attempt to delete initial staging files to cover tracks. Talos also observed the deployment of other implants like Gh0stCringe and SPECTRE in similar campaigns.
The secondary batch script establishes persistence by creating deceptive scheduled tasks named "Google Chrome Start" that run the malware with high privileges upon user logon. For BadIIS deployment, the threat actor adds standard IIS directories ("System32\inetsrv" and "SysWOW64\inetsrv") to Windows Defender's exclusion list, downloads the archived BadIIS ("dll.zip") and a third execution script ("user.bat") using `certutil`, and conducts local reconnaissance with `appcmd` to identify injection targets. Finally, "user.bat" is executed with elevated privileges to create a rogue local user account, adding it to the Administrators and Remote Desktop Users groups for persistent, highly privileged RDP access.
For Linux systems, the attack begins with an RCE payload to gain a foothold, followed by the deployment of a web shell for persistent command execution. The threat actor then proceeds with further actions leveraging this access.
