A Chinese-speaking intrusion actor, identified as UAT-10147, is deploying a sophisticated cross-platform implant called SPECTRE, which includes a Linux rootkit and "Bring Your Own Virtual Driver" (BYOVD) capabilities for bypassing endpoint detection and response (EDR) systems. The group targets IIS and Linux servers, engaging in both search engine optimization (SEO) fraud and advanced post-exploitation activities.
The SPECTRE implant, written in C, represents an evolution in commodity intrusion tooling, offering cross-platform command-and-control (C2) operations, process injection, credential theft, and anti-analysis protections. Researchers noted that portions of the Linux rootkit and the SPECTRE backdoor itself show indications of AI-assisted code generation, suggesting a growing role for generative AI in malware development.
UAT-10147's toolkit is diverse, encompassing custom malware, open-source offensive tools, and both off-the-shelf and custom-developed backdoors. The group has been observed using AI-assisted exploitation workflows to compromise internet-facing IIS and Linux servers at scale.
Development artifacts, including PDB paths, link some of the SEO fraud components to an individual or entity referred to as "x神" ("xshen"). Specifically, PDB paths in BadIIS malware samples reference "C:\Users\Administrator\Desktop\2025-11-21 (x神订制全站劫持按浏览器语言跳转)\dll\Release\demo.pdb" and "C:\Users\Administrator\Desktop\x神的自安装服务\svchost\x64\Release\service.pdb." Other components, such as the ASHX SEO engine configuration and a web shell, also contain references to "X," like "X-seo" and an "X-ID" HTTP header used for covert authentication.
The SPECTRE implant was named based on a debug log recovered from a sample, which explicitly displayed "SPECTRE" in its header, meticulously recording each step of the malware's execution.
The Windows variant of SPECTRE distinguishes itself from the stock Havoc framework through custom post-exploitation and defense evasion features compiled directly into the binary. It heavily prioritizes obfuscation and anti-analysis. API resolution is performed at runtime using PEB hash walking and a DJB2 variant algorithm. String encryption uses a per-string xorshift32 pseudorandom number generator (PRNG) scheme, with sensitive literals encrypted at compile time and decrypted to thread local storage immediately before execution, preventing their storage in plaintext within the ".text" or ".rdata" sections. This design makes static detection methods largely ineffective.
SPECTRE incorporates an anti-analysis scoring routine that evaluates factors such as process name blocklists, RAM capacity, CPU core count, disk space, sleep acceleration detection, and common sandbox hostnames and usernames. If a cumulative score of 50 points or more is reached, the process self-terminates.
A fallback C2 domain is hardcoded within the binary and can be recovered through string decryption. All C2 communications are transmitted via HTTP POST requests to the "/api/v1/register" and "/api/v1/output" endpoints. One observed version of the implant attempts to read its C2 configuration from an NTFS Alternate Data Stream (ADS) located at "C:\Windows\System32\drivers\etc\hosts:cache." This allows the threat actor to update the C2 configuration without recompiling the binary, bypassing firewall blocklists.
The Windows SPECTRE backdoor supports 45 commands, with 24 appearing as plaintext comparands and 21 encrypted with the xorshift PRNG. These commands include standard shell operations (e.g., `shell`, `pwd`, `ls`, `cat`), file manipulation (`mkdir`, `rm`, `cp`, `mv`, `download`, `upload`), process management (`ps`, `kill`), system information (`env`, `sleep`, `sysinfo`, `whoami`, `netinfo`), and defense evasion (`timestomp`, `selfdel`, `reg`). More advanced, encrypted commands include `regset` for registry writes, `inject` for DLL injection, `s-nject` for shellcode injection, `getsystem` for privilege escalation, `steal_token` and `make_token` for token theft, `earlybird` for APC EarlyBird injection, `hollow` for process hollowing, and `keylog_start`/`stop`/`dump` for keystroke logging. Credential theft capabilities include `hashdump` for SAM/SYSTEM/SECURITY hives and `chromedump` for Chrome and Edge login data. The implant also features `execute_assembly` for in-memory .NET CLR hosting and `vaultdump`.
Crucially, SPECTRE includes BYOVD EDR killer capabilities, with commands such as `byovd_load` (for RTCore64/DBUtil drivers), `byovd_unload`, `edr_kill` (to terminate EDR processes), `callbacks` (to enumerate kernel callbacks), `proc_hide` (to hide processes from kernel lists), and `byovd_verify` (to verify kernel read/write access).
