UAT-10147 Uses AI to Scale Server Attacks Deploys SPECTRE With EDR Bypass and Linux Rootkit
Cybersecurity experts have revealed information on UAT-10147, a Chinese-speaking cybercrime group that targets Windows and Linux web servers worldwide in the media, gaming, education, and technology industries.
Brazil, Bolivia, China, Canada, and Vietnam are home to the great majority of the targets. The discovery of an open directory hosted at "139.180.197[.]150," which was seen interacting with one of the infected machines, provided information about the threat behavior.
In a two-part study released last week, Cisco Talos stated that the actor used publicly known vulnerabilities to obtain first access at scale. To automate infiltration activities and create persistence, the actor used a variety of open-source offensive frameworks, such as Metasploit, ysoserial, PentestGPT, DeepAud...