Cisco Talos published research in August 2026 tracking a Chinese-speaking cybercrime group, designated UAT-10147, that has been compromising Windows and Linux servers across education, media, technology, and gaming organizations in Brazil, Bolivia, China, Canada, and Vietnam. What makes the group worth paying attention to isn’t a novel exploit; most of what it weaponizes is already-known, already-patchable vulnerabilities. What’s changed is the speed the group operates at, because AI tooling is now doing a meaningful share of the work.
AI as a force multiplier, not a new attack type
According to The Hacker News’ coverage of the Talos report, UAT-10147 uses AI across multiple phases of an intrusion: refining exploits, troubleshooting exploit logic that doesn’t work on the first try, automating post-exploitation workflows, validating whether an exploit actually succeeded, and even generating operational documentation for the group’s own use. Named tools in the group’s kit include PentestGPT, an autonomous pentesting framework, and DeepAudit, used for vulnerability scanning. None of this is a fundamentally new capability; skilled human operators have done all of these steps manually for years. What AI changes is how many targets one operator can move through in a day, and how much lower the skill floor is for the operators doing it.
That’s the part that should worry a small hosting customer more than the specific malware names. A slower, more selective attacker tends to go after high-value targets worth the manual effort. An AI-accelerated attacker can afford to work through a long list of smaller, less prominent servers, because the marginal cost of trying the next one has dropped.
How the group gets in
On Windows, initial access runs primarily through IIS servers via ASP.NET ViewState deserialization, a long-standing class of vulnerability in .NET web applications that improperly validate serialized data. On Linux, the group draws from a list of known, weaponized CVEs: Zimbra (CVE-2022-27925), AjaxPro (CVE-2021-23758), Telerik (CVE-2019-18935), and Nacos (CVE-2021-29441 and CVE-2021-29442), alongside six separate Linux local privilege escalation exploits used once initial access is established. Every one of those has a patch available; none of them is a zero-day. The exposure here is entirely about patch lag, not about defending against something unknown.
What lands once the group is in: SPECTRE and the EDR bypass
The payload delivered after successful exploitation is a cross-platform backdoor called SPECTRE, written in C, supporting 45 distinct commands covering file operations, keylogging, screenshot capture, process injection, and credential theft, along with anti-analysis protections designed to resist reverse engineering.
The more concerning piece is how SPECTRE operates once it’s running. The Talos analysis details how the threat actor deploys implants like Gh0stCringe, Quasar RAT, and the cross-platform SPECTRE backdoor, utilizing various batch scripts, web shells, and PowerShell commands to maintain persistence and execute malicious workflows. Seeing it paired with AI-accelerated initial access against ordinary web-facing servers is the notable part of this specific campaign.
On the Linux side, the group deploys backdoors like Noodle RAT, SPECTRE, and Meterpreter to enable outbound connections to remote C2 infrastructure, along with utilizing various known local privilege escalation exploits to obtain root-level access.
Why a technique from 2018 still works in 2026
BYOVD isn’t new, and Microsoft’s vulnerable driver blocklist has existed for years specifically to close this exact door: it’s a list of driver signatures Windows refuses to load, updated periodically. The uncomfortable detail is that the blocklist isn’t universally enabled by default across every Windows Server configuration and deployment path, particularly on older installations or ones where it was manually disabled for a legacy compatibility reason and never re-enabled. A driver that’s been on a public blocklist for years still works against a system that never applied the setting blocking it, which is a configuration gap, not a missing patch, and configuration gaps don’t show up on a routine patch report the way a missing security update does.
What to look for on a Linux server that’s already compromised
A compromised server operating under a rootkit or persistent backdoor is deliberately built to be hard to spot from inside a system. A few checks still apply, imperfect but genuinely useful: comparing the output of system commands against a known-good baseline taken when the server was first provisioned, since unfamiliar modifications appearing later are worth investigating; checking for unexplained process and load events in system logs around the time unusual outbound traffic first appeared; and, where practical, booting from an external rescue environment to inspect the system’s files and loaded components from outside the potentially compromised OS. None of these are foolproof against a well-built intrusion, which is exactly why prevention, patching the initial-access vulnerabilities before they’re exploited, matters more here than detection after the fact.
Why the patch list matters more than the malware names
Every initial-access vector in this campaign traces back to a CVE with a patch already published, some going back to 2019 and 2021. That’s not unusual for opportunistic campaigns; attackers running vulnerability scanners at scale don’t need a zero-day when a meaningful share of internet-facing servers haven’t applied a four-year-old patch.
For anyone running a VPS or dedicated server, the practical checklist this campaign points to is short and unglamorous: confirm ASP.NET ViewState validation is properly configured if running IIS, confirm Zimbra, Telerik UI, Nacos, and AjaxPro installations (if any of these are in use) are on current patched versions, and confirm the OS-level vulnerable driver blocklist is enabled rather than assumed to be on by default, which on Windows Server can be checked directly against Microsoft’s published blocklist policy setting. None of this requires exotic tooling. It requires patch and configuration discipline that a lot of servers, based on how this campaign is finding victims at all, simply don’t have.
Where managed patching actually pays for itself
This is one of the clearer real-world cases for why a managed hosting arrangement, where the provider handles OS and platform patching on a defined schedule rather than leaving it to whoever last had time, closes off an entire category of this kind of attack before it starts. A server running unpatched, multi-year-old CVEs isn’t unusual because site owners are careless; it’s usually because patching isn’t anyone’s clearly assigned job on a small team. UAT-10147’s entire access strategy depends on that gap existing at scale, which is exactly the gap a managed VPS plan with a defined patching cadence is built to close.
The bottom line
None of the individual exploits UAT-10147 uses are new, and none of the CVEs are unpatched by their vendors. What’s new is the speed and scale AI tooling lets one group work through targets, and the sophistication of the backdoor capabilities waiting on the other side of a successful, entirely preventable initial compromise. The defense against it is the least exciting kind: keep the patch list current, confirm driver and system blocklists are actually active, and maintain rigorous baseline monitoring across your infrastructure.