15 minhigh
UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
UAT-10147 is a Chinese-speaking cybercrime group that targets internet-exposed Windows and Linux web servers using publicly disclosed vulnerabilities for initial access. The group integrates AI-driven offensive tools including PentestGPT and DeepAudit to automate exploitation, reconnaissance, payload generation, and validation workflows. Post-compromise activities include deploying BadIIS for SEO fraud, QuasarRAT and SPECTRE implants for persistent access, and creating rogue local admin accounts on Windows systems. The actor demonstrated semi-autonomous offensive orchestration through AI-generated operational playbooks documenting complete ASP.NET ViewState deserialization RCE chains.
Sens:■ Immediate
Showing defanged values
- cveCVE-2010-3904Flaw in rds_page_copy_user function allowing unprivileged user to write to arbitrary kernel memory addresses.
- cveCVE-2015-3246Improper file handling in libuser roothelper allowing corruption of /etc/passwd to gain root access.
- cveCVE-2015-5287Symbolic link handling flaw in ABRT Automatic Bug Reporting Tool exploited for local privilege escalation.
- cveCVE-2019-18935.NET JSON deserialization vulnerability enabling arbitrary file upload and remote code execution.
- cveCVE-2021-23758Deserialization remote code execution vulnerability in AjaxPro exploited for initial access.
- cveCVE-2021-29441Arbitrary code execution via ScriptEngineFactory Service Provider Interface allowing OS-level shell execution.
- cveCVE-2021-29442Arbitrary code execution vulnerability in Nacos framework exploited alongside CVE-2021-29441.
- cveCVE-2021-3156Heap-based buffer overflow in sudo allowing any local user to gain root privileges without authentication.
- cveCVE-2022-0847Allows unprivileged users to overwrite data in read-only files by exploiting pipe buffer handling flaws.
- cveCVE-2022-0995Out-of-bounds write in Linux kernel watch_queue mechanism allowing unprivileged user to escalate privileges.
- cveCVE-2022-27925Unauthenticated remote code execution in Zimbra Collaboration Suite used for initial access.
- domainadminapi[.]tippusoni[.]inDownload server domain hosting privilege escalation tools, batch scripts, QuasarRAT payload, BadIIS module, and execution scripts for the Windows infection chain.
- filenameC:\ProgramData\bai.batSecondary batch script downloaded for persistence and backdoor execution.
- filenameC:\ProgramData\dll.zipBadIIS malicious IIS module archive downloaded for deployment.
- filenameC:\ProgramData\prcc1.rarEfsPotato privilege escalation tool downloaded and renamed from pr.exe on the victim system.
- filenameC:\ProgramData\user.batThird execution script downloaded for rogue account creation.
- filenameC:\Users\dajiba\Desktop\phantom-v2\data\arsenal\webshells\sss.ashxLocal path on attacker machine where the web shell sss.ashx is sourced from before uploading to victim IIS servers.
- filenameC:\Users\Public\Music\svchosts.exeQuasarRAT payload dropped to a non-standard directory added to Defender exclusion list.
- filenamesss.ashxFinal ASHX web shell deployed to compromised IIS server webroot via a two-step upload relay through up.ashx. Accepts commands via POST parameters {'a': 'Execute', 'cmd': 'whoami', 'p': 'dir'}.
- filenamesvchosts.exeQuasarRAT payload disguised with a name mimicking the legitimate Windows service host process. Dropped to C:\Users\Public\Music\ or C:\ProgramData\ depending on campaign variant.
- ip139[.]180[.]197[.]150Primary C2 and download server with open directory hosting implants, tools, and target URL lists. Also serves as secondary staging server for web shell deployment on port 54321.
- ip18[.]140[.]163[.]186Attacker-controlled Nacos configuration server used as an asynchronous exfiltration sink. Victims POST system telemetry (hostname, username) to the Nacos config API endpoint to confirm successful exploitation.
- registry_keyHKLM\SOFTWARE\Microsoft\WindowsDefender\Exclusions\PathsWindows Defender exclusion path registry key modified to add IIS directories (System32\inetsrv, SysWOW64\inetsrv) and other paths to blind antivirus scanning.
- urlhxxps://adminapi[.]tippusoni[.]in/4/bai[.]txtSecondary batch script (bai.bat) downloaded to establish persistence via scheduled tasks and execute the backdoor.
- urlhxxps://adminapi[.]tippusoni[.]in/4/dll[.]zipBadIIS malicious IIS module downloaded and extracted to ProgramData for deployment into IIS directories.
- urlhxxps://adminapi[.]tippusoni[.]in/4/pr[.]exeEfsPotato privilege escalation tool downloaded via certutil and renamed to prcc1.rar on the victim system.
- urlhxxps://adminapi[.]tippusoni[.]in/4/svchosts[.]exeQuasarRAT payload disguised as svchosts.exe, downloaded to victim machine via certutil.
- urlhxxps://adminapi[.]tippusoni[.]in/4/user[.]txtThird execution script (user.bat) downloaded to create a rogue local admin account for persistent RDP access.
Detection / Hunteropenrouter
What Happened
A Chinese-speaking criminal group called UAT-10147 has been breaking into web servers around the world by exploiting known software vulnerabilities that have available fixes. What makes this group notable is their use of artificial intelligence tools to automate and guide their attacks, from finding weaknesses to generating attack code and verifying that exploits work. They target organizations in government, education, media, technology, and gaming sectors across multiple countries. Once inside, they install malware for search engine fraud and data theft, create hidden backdoor accounts, and disable antivirus protections. Organizations running internet-facing web servers, especially those using Zimbra, Nacos, Telerik, or ASP.NET with exposed encryption keys, should patch all known vulnerabilities immediately and review their server configurations for signs of compromise.
Key Takeaways
- UAT-10147 is a Chinese-speaking cybercrime group that integrates agentic AI tools (PentestGPT, DeepAudit) into exploitation, reconnaissance, payload generation, and validation workflows
- The actor targets internet-exposed Windows and Linux web servers using publicly disclosed vulnerabilities including Zimbra, AjaxPro, Nacos, and Telerik UI flaws
- AI-generated operational playbooks document a complete ASP.NET ViewState deserialization RCE chain including key validation, payload generation via ysoserial, OOB confirmation, and post-exploitation persistence
- Windows persistence involves Defender exclusion path manipulation via PowerShell and Registry, scheduled tasks disguised as Google Chrome, and rogue local admin account creation
- Linux post-exploitation leverages six known LPE exploits ranging from CVE-2010-3904 to CVE-2022-0847 (Dirty Pipe) to achieve root before deploying NoodleRAT, SPECTRE, and Meterpreter implants
Affected Systems
- Windows web servers running IIS
- Linux web servers
- Zimbra Collaboration Suite
- Nacos framework deployments
- Telerik UI for ASP.NET AJAX
- AjaxPro deserialization targets
- ASP.NET applications with exposed MachineKeys
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2022-27925 | Zimbra Collaboration Suite | Unauthenticated remote code execution in Zimbra Collaboration Suite used for initial access. | |
| CVE-2021-23758 | AjaxPro | Deserialization remote code execution vulnerability in AjaxPro exploited for initial access. | |
| CVE-2021-29441 | Nacos framework | Arbitrary code execution via ScriptEngineFactory Service Provider Interface allowing OS-level shell execution. | |
| CVE-2021-29442 | Nacos framework | Arbitrary code execution vulnerability in Nacos framework exploited alongside CVE-2021-29441. | |
| CVE-2019-18935 | Telerik UI for ASP.NET AJAX | .NET JSON deserialization vulnerability enabling arbitrary file upload and remote code execution. | |
| CVE-2022-0995 | Linux kernel watch_queue event notification | Out-of-bounds write in Linux kernel watch_queue mechanism allowing unprivileged user to escalate privileges. | |
| CVE-2021-3156 | sudo (Baron Samedit) | Heap-based buffer overflow in sudo allowing any local user to gain root privileges without authentication. | |
| CVE-2015-5287 | ABRT sosreport | Symbolic link handling flaw in ABRT Automatic Bug Reporting Tool exploited for local privilege escalation. | |
| CVE-2015-3246 | libuser roothelper | Improper file handling in libuser roothelper allowing corruption of /etc/passwd to gain root access. | |
| CVE-2010-3904 | Linux kernel RDS protocol | Flaw in rds_page_copy_user function allowing unprivileged user to write to arbitrary kernel memory addresses. | |
| CVE-2022-0847 | Linux kernel pipe buffers (Dirty Pipe) | High | Allows unprivileged users to overwrite data in read-only files by exploiting pipe buffer handling flaws. |
Attack Chain
- Initial Access: Threat actor exploits publicly disclosed vulnerabilities (Zimbra CVE-2022-27925, AjaxPro CVE-2021-23758, Nacos CVE-2021-29441/29442, Telerik CVE-2019-18935, ASP.NET ViewState deserialization) to achieve RCE on internet-exposed web servers
- Execution: Main batch script (back.txt/back.bat) runs certutil to download EfsPotato privilege escalation tool, secondary batch script, and QuasarRAT payload from adminapi.tippusoni.in
- Privilege Escalation: EfsPotato (renamed prcc1.rar) exploits SeImpersonatePrivilege to gain SYSTEM on Windows; Linux uses six known LPE exploits including Dirty Pipe (CVE-2022-0847) and Baron Samedit (CVE-2021-3156)
- Defense Evasion: PowerShell Add-MpPreference and Registry modifications add IIS directories and staging paths to Windows Defender exclusion list
- Persistence: Scheduled task 'Google Chrome Start' created with ONLOGON trigger at HIGHEST privilege; rogue local admin account added to Administrators and Remote Desktop Users groups; ASHX web shell deployed to IIS webroot
- Discovery and Exfiltration: AI-generated Python scripts enumerate webroot, IIS site configurations, and privilege tokens; data exfiltrated via HTTP POST to webhook.site endpoints or attacker-controlled Nacos configuration server
Detection Availability
- YARA Rules: Yes
- Sigma Rules: Yes
- Snort/Suricata Rules: Yes
- KQL Queries: Yes
- Splunk SPL Queries: Yes
- EQL Queries: Yes
- Other Detection Logic: Yes
- Platforms: ClamAV, Snort2, Snort3, GitHub
ClamAV signatures (Py.Loader.Tool-10060293-1, Py.Loader.Tool-10060293-2, Win.Malware.Generic-10060228-0, Win.Loader.Downloader-10060287-1) and Snort rules (SIDs 66697, 66696 for both Snort2 and Snort3) are available. Additional IOCs are published in the Talos GitHub repository.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can observe certutil downloads, PowerShell Add-MpPreference invocations, scheduled task creation, and net user commands. However, the actor uses encoded PowerShell commands for reconnaissance and the ViewState deserialization payload executes within the IIS worker process context, which may blend with legitimate IIS activity. |
| Network Visibility | Medium | Network monitoring can detect certutil downloads from adminapi.tippusoni.in and connections to 139.180.197.150. However, exfiltration via Nacos configuration API and webhook.site endpoints blends with legitimate SaaS traffic over HTTPS. The ViewState RCE succeeds silently within HTTP 500 error responses, which is a defensive blind spot for tools that only alert on successful HTTP status codes. |
| Detection Difficulty | Hard | The actor uses multiple legitimate administrative tools (certutil, PowerShell, schtasks, appcmd, net) that generate high false positive rates. Exfiltration via Nacos API and webhook.site blends with legitimate SaaS traffic. ViewState deserialization RCE succeeds within HTTP 500 error streams. AI-generated scripts use encoded PowerShell commands to evade AMSI and script logging. The combination of living-off-the-land techniques and traffic blending makes reliable detection challenging without behavioral correlation. |
Required Log Sources
- Windows Event Log - Security (Event ID 4688 Process Creation)
- Windows Event Log - Security (Event ID 4720 Account Creation, 4732 Group Membership)
- Windows Event Log - System (Event ID 104 State Management)
- PowerShell Script Block Logging (Event ID 4104)
- IIS W3SVC logs for HTTP 500 errors with InvalidCastException
- Sysmon Event ID 1 (Process Creation), 11 (File Creation), 13 (Registry Value Set)
- DNS resolution logs for OOB confirmation callbacks
- Windows Defender event logs for exclusion path additions
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for certutil.exe making outbound network connections to non-Microsoft domains, as the actor uses certutil as a download tool for payloads and tools from attacker infrastructure. | Process creation logs with command line arguments, network connection logs from EDR or firewall | Execution | Medium — certutil is a legitimate Windows tool occasionally used by administrators for certificate operations, but outbound HTTP downloads to external domains are uncommon. |
| Consider hunting for PowerShell Add-MpPreference cmdlet invocations adding exclusion paths, especially targeting IIS directories (System32\inetsrv, SysWOW64\inetsrv) or non-standard paths like C:\Users\Public\Music. | PowerShell Script Block Logging (Event ID 4104), Sysmon Registry Value Set (Event ID 13), Windows Defender operational logs | Defense Evasion | Low — Add-MpPreference is rarely used in enterprise environments and adding IIS directories to exclusions is highly suspicious. |
| Consider hunting for scheduled tasks named 'Google Chrome Start' or similar deceptive names configured with ONLOGON triggers and HIGHEST privilege running from non-standard paths. | Windows Task Scheduler logs, Sysmon Event ID 1 for schtasks.exe process creation with command line, scheduled task XML exports | Persistence | Low — legitimate Google Chrome updates do not create ONLOGON scheduled tasks with HIGHEST privilege from non-standard paths. |
| Consider hunting for IIS W3SVC logs containing HTTP 500 responses with InvalidCastException in the error message, as this indicates successful ViewState deserialization exploitation rather than a failure. | IIS W3SVC logs, HTTP error response logs, WAF logs capturing response body content | Exploitation | Medium — HTTP 500 errors are common in web applications, but the specific InvalidCastException pattern combined with ViewState parameters narrows the scope significantly. |
| Consider hunting for net.exe creating local user accounts followed by immediate addition to both Administrators and Remote Desktop Users groups, as the actor creates rogue accounts for persistent RDP access. | Windows Security Event ID 4720 (Account Created), 4732 (Member Added to Group), 4728 (Member Added to Administrators) | Persistence | Low — legitimate local account creation followed by immediate addition to both Administrators and Remote Desktop Users is rare in production web servers. |
Control Gaps
- Network monitoring tools that only alert on successful HTTP status codes will miss ViewState RCE exploitation succeeding within HTTP 500 error responses
- Antivirus exclusion path additions via PowerShell and Registry may not trigger alerts if Defender operational logs are not centrally collected
- Exfiltration via Nacos configuration API and webhook.site endpoints blends with legitimate SaaS traffic and may not be flagged by DLP or network monitoring
- AI-generated Python scripts running on attacker infrastructure and orchestrating attacks against victim servers are not visible to victim-side endpoint controls
- Encoded PowerShell commands may bypass AMSI and script block logging depending on the victim's configuration and PowerShell version
Key Behavioral Indicators
- certutil.exe with -urlcache flag downloading files from external domains
- PowerShell Add-MpPreference cmdlet adding exclusion paths for IIS directories or non-standard locations
- Registry modifications to HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
- Scheduled task creation with deceptive names (Google Chrome Start) using ONLOGON trigger and HIGHEST privilege
- net.exe creating local users and adding them to Administrators and Remote Desktop Users groups in rapid succession
- appcmd.exe list site commands executed from non-administrator contexts or unusual parent processes
- ysoserial.exe process execution on Windows systems
- HTTP 500 responses containing InvalidCastException in IIS logs indicating successful ViewState deserialization
- PowerShell [IO.File]::WriteAllBytes method used to write ASHX files to IIS webroot directories
- Connections to Nacos configuration API endpoints from non-administrative hosts
False Positive Assessment
Medium — The actor extensively uses legitimate Windows administrative tools (certutil, PowerShell, schtasks, net, appcmd) which generate noise in environments with active system administration. However, specific combinations such as certutil downloading from external domains, Add-MpPreference targeting IIS directories, and scheduled tasks named 'Google Chrome Start' with ONLOGON triggers are distinctive enough to warrant investigation with low false positive rates.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking the identified C2 IP addresses (139.180.197.150, 18.140.163.186) and domain (adminapi.tippusoni.in) at your perimeter firewall and proxy infrastructure.
- If you have EDR with host isolation capability, consider isolating any Windows or Linux web servers observed communicating with the identified C2 infrastructure.
- Consider hunting for Windows Defender exclusion paths containing IIS directories (System32\inetsrv, SysWOW64\inetsrv) or non-standard paths (C:\Users\Public\Music) across your server fleet.
- Consider auditing scheduled tasks on IIS servers for entries named 'Google Chrome Start' or similar deceptive names with ONLOGON triggers.
- Consider reviewing local user account creation events on web servers for rogue accounts added to Administrators and Remote Desktop Users groups.
Infrastructure Hardening
- Evaluate whether all internet-facing web server software (Zimbra, Nacos, Telerik UI, AjaxPro) is patched to versions that address the CVEs listed in this report.
- Consider rotating ASP.NET MachineKeys if there is any possibility of exposure, as ViewState deserialization exploitation depends entirely on key material compromise.
- If applicable, consider implementing network segmentation to restrict web servers from making outbound connections to non-whitelisted destinations.
- Consider deploying ClamAV signatures (Py.Loader.Tool-10060293-1, Py.Loader.Tool-10060293-2, Win.Malware.Generic-10060228-0, Win.Loader.Downloader-10060287-1) and Snort rules (SIDs 66697, 66696) if your infrastructure supports these tools.
- Evaluate whether IIS application pools are configured to run with least privilege and whether SeImpersonatePrivilege can be restricted for IIS worker processes.
User Protection
- Consider enabling PowerShell Script Block Logging (Event ID 4104) on all Windows servers if not already deployed, to capture encoded PowerShell reconnaissance commands.
- If your EDR supports it, consider creating detection rules for certutil.exe making outbound HTTP connections to external domains.
- Consider deploying Sysmon with process creation, file creation, and registry value set logging on critical web servers if not already in place.
- Evaluate whether Windows Defender tamper protection is enabled to prevent exclusion path modifications via PowerShell and Registry.
Security Awareness
- Consider incorporating awareness of AI-assisted attack workflows into existing threat intelligence briefings, as this campaign demonstrates a shift from AI-assisted scripting toward semi-autonomous offensive orchestration.
- If your organization operates web servers, consider reminding server administrators that known vulnerability patching remains the most critical defensive control against this threat actor.
- Consider briefing server administration teams on the tactic of adding IIS directories to Defender exclusion lists, as this is a specific defense evasion technique used in this campaign.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping14 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Discovery
Tactic
Command and Control
Additional IOCs
- Registry Keys:
HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths- Windows Defender exclusion path registry key modified to add IIS directories (System32\inetsrv, SysWOW64\inetsrv) and other paths to blind antivirus scanning.
- File Paths:
C:\ProgramData\prcc1.rar- EfsPotato privilege escalation tool downloaded and renamed from pr.exe on the victim system.C:\ProgramData\bai.bat- Secondary batch script downloaded for persistence and backdoor execution.C:\ProgramData\dll.zip- BadIIS malicious IIS module archive downloaded for deployment.C:\ProgramData\user.bat- Third execution script downloaded for rogue account creation.C:\Users\Public\Music\svchosts.exe- QuasarRAT payload dropped to a non-standard directory added to Defender exclusion list.C:\Users\dajiba\Desktop\phantom-v2\data\arsenal\webshells\sss.ashx- Local path on attacker machine where the web shell sss.ashx is sourced from before uploading to victim IIS servers.
- Command Lines:
- Purpose: Download privilege escalation tool, batch scripts, and RAT payload from remote server | Tools:
certutil| Stage: Initial deployment |certutil -urlcache -split -f <url> <dest> - Purpose: Add IIS directories to Windows Defender exclusion list to blind antivirus | Tools:
powershell,Add-MpPreference| Stage: Defense evasion |powershell Add-MpPreference -ExclusionPath <path> - Purpose: Add Defender exclusion paths via Registry modification as alternative to PowerShell cmdlet | Tools:
reg.exe| Stage: Defense evasion - Purpose: Create scheduled task disguised as Google Chrome for persistence running RAT at highest privileges on logon | Tools:
schtasks.exe| Stage: Persistence - Purpose: Enumerate IIS website configurations to identify injection targets for BadIIS module | Tools:
appcmd.exe| Stage: Reconnaissance |C:\Windows\system32\inetsrv\appcmd list site /config /xml - Purpose: Create rogue local user and add to Administrators and Remote Desktop Users groups for persistent RDP access | Tools:
net.exe| Stage: Persistence - Purpose: Exfiltrate system telemetry to attacker-controlled Nacos configuration server via curl | Tools:
curl| Stage: Exfiltration - Purpose: Execute encoded PowerShell reconnaissance commands to collect system info, privileges, and IIS configuration | Tools:
powershell| Stage: Reconnaissance |powershell -nop -enc <base64> - Purpose: Generate ViewState deserialization payload using ysoserial for ASP.NET RCE | Tools:
ysoserial.exe| Stage: Exploitation
- Purpose: Download privilege escalation tool, batch scripts, and RAT payload from remote server | Tools:
- Other:
shell.elf- Linux ELF implant observed in the C2 server open directory listing.up.ashx- Temporary file upload handler written to IIS webroot as an intermediate relay to upload the final web shell sss.ashx.back.txt- Primary multi-stage malware deployment batch script name observed on compromised Windows servers. Also observed as back.bat.
