UAT-10147 Integrates Agentic AI into Post-Compromise Operations

Cisco Talos has identified UAT-10147, a Chinese-speaking cybercrime group, utilizing agentic AI to enhance post-compromise operations. The group targets a wide variety of sectors including government, education, and technology across regions like Brazil, Bolivia, and Vietnam. While their primary goals involve SEO fraud and data theft, their use of AI represents a significant shift from simple scripting to adaptive, semi-autonomous offensive orchestration.

The actor employs a hybrid strategy, combining exploitation of known 'one-day' vulnerabilities (e.g., CVE-2022-27925, CVE-2022-0847) with AI-generated operational playbooks and validation scripts. They utilize a diverse malware arsenal including the cross-platform SPECTRE implant, BadIIS, and QuasarRAT. By integrating frameworks like PentestGPT, UAT-10147 can automate complex attack chains, such as ASP.NET ViewState deserialization, with high efficiency and low operational overhead.

This campaign highlights the maturing capability of threat actors to operationalize AI for scaling intrusions. The high volume of target lists—reaching up to 170,000 URLs—indicates a significant threat to internet-exposed web infrastructure. Organizations must prioritize MachineKey confidentiality and patch management for public-facing web servers to mitigate these automated threats.