Chinese hackers use AI to automate attacks on 170,000 servers

A Chinese-speaking cybercrime group is using AI-assisted tooling to automate attacks against vulnerable Windows and Linux web servers worldwide.

Tracked as UAT-10147 by Cisco Talos, the threat group targets internet-facing servers for data theft and search engine optimization (SEO) fraud, combining publicly available exploits, offensive security frameworks, custom malware, and increasingly sophisticated AI-generated attack workflows.

Talos researcher Joey Chen said the activity was discovered in early 2026 after investigators observed a compromised system communicating with a download server. An operational-security mistake left the server's directory publicly accessible, exposing malware, scripts, tooling, and a target list containing roughly 170,000 URLs.

The targets included government agencies, universities, media organizations, technology companies, and gaming businesses in countries including Brazil, Bolivia, China, Canada, and Vietnam.

AI turns exploitation into a repeatable workflow

UAT-10147 typically compromises servers by exploiting known vulnerabilities affecting products such as Zimbra, AjaxPro, Nacos, and Telerik UI. On Windows IIS servers, its scripts can elevate privileges, add IIS directories to Microsoft Defender exclusions, deploy backdoors, create administrator accounts, and establish scheduled-task persistence.

On Linux, the group deploys web shells and uses multiple local privilege escalation exploits, including Dirty Pipe (CVE-2022-0847) and Baron Samedit (CVE-2021-3156), before installing additional implants.

What makes the campaign notable is how deeply AI is integrated into post-compromise activity.

Talos found PentestGPT and DeepAudit on attacker-controlled infrastructure, along with AI-generated documentation and Python scripts for exploit validation, troubleshooting, identifying writable directories, deploying implants, installing web shells, and exfiltrating reconnaissance data.

One recovered ASP.NET ViewState exploitation guide covered MachineKey validation, ysoserial payload generation, out-of-band execution checks, reconnaissance, privilege escalation, and persistence. It also contained details from an actual intrusion, indicating the material was being used operationally rather than as a lab exercise.

Talos assesses with moderate-to-high confidence that UAT-10147 belongs to an emerging class of financially motivated actors using agentic AI to turn advanced offensive techniques into scalable, semi-automated workflows.

SPECTRE adds kernel-level evasion

The group's most capable payload is SPECTRE, a custom C backdoor built for both Windows and Linux.

The Windows version supports 45 commands covering screenshots, credential theft, keylogging, token impersonation, process injection, in-memory .NET execution, and privilege escalation. It can also perform Bring Your Own Vulnerable Driver (BYOVD) attacks using vulnerable MSI or Dell drivers to tamper with kernel callbacks used by endpoint detection products, reducing visibility into malicious activity.

The Linux version offers 29 commands and can deploy a companion kernel rootkit named Specter. Disguised as acpi_pad.ko, the module can hide processes and itself, elevate the implant to root, and persist through a fake hardware-monitor.service systemd unit configured to load early during boot.

Talos believes portions of the Linux rootkit may also have been developed with AI assistance, citing unusually structured comments, instructional explanations, and multiple alternative implementation methods in recovered source code.

UAT-10147 also uses QuasarRAT, Gh0stCringe, Noodle RAT, Meterpreter, web shells, and BadIIS malware for persistence and SEO manipulation. One IIS SEO component was specifically configured to target Vietnamese users and search crawlers.

Defending exposed web servers

Administrators should prioritize patching internet-facing IIS and Linux servers, rotate exposed ASP.NET MachineKeys, and restrict unnecessary administrative interfaces.

Defenders should also investigate unexpected Microsoft Defender exclusions, suspicious scheduled tasks or systemd services, unfamiliar kernel modules, and the presence of known vulnerable drivers. Monitoring outbound connections to webhook services and unknown C2 infrastructure can help identify compromised servers before attackers establish durable persistence.