12 minhigh
UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities
UAT-10147, a Chinese-speaking threat actor, deploys SPECTRE, a cross-platform backdoor targeting IIS and Linux servers. SPECTRE integrates BYOVD-based EDR neutralization via vulnerable drivers, process injection, credential theft, and a Linux kernel rootkit called Specter that uses ftrace for syscall hooking. The actor also employs SEO fraud utilities, Potato family privilege escalation tools, and multiple commodity backdoors. Evidence of AI-assisted development is present in both SPECTRE and Specter source code.
Sens:▲ 24h
Showing defanged values
- cveCVE-2019-16098Arbitrary kernel memory read/write through the RTCore64.sys driver, exploited for BYOVD EDR neutralization
- cveCVE-2021-21551Arbitrary kernel memory read/write through the Dell DBUtil driver, exploited for BYOVD EDR neutralization
- domainudvyiwvfs[.]cyouHardcoded C2 domain for SPECTRE backdoor, used by both Windows and Linux variants for beaconing and command dispatch over HTTPS port 443
- filenameacpi_pad.koSpecter Linux rootkit deployed disguised as the legitimate ACPI processor power management kernel module; verify against known-good module hash if found loaded from non-standard paths
- filenameC:\Users\Administrator\Desktop\2025-11-21x神订制全站劫持按浏览器语言跳转\dll\Release\demo.pdbPDB path embedded in BadIIS malware linking to developer xshen; Chinese text translates to xshen custom full-site hijack redirect by browser language
- filenameC:\Users\Administrator\Desktop\2025-11-21x神订制全站劫持按浏览器语言跳转\dll\x64\Release\demo.pdbPDB path embedded in 64-bit BadIIS malware variant linking to developer xshen
- filenameC:\Users\Administrator\Desktop\x神的自安装服务\svchost\x64\Release\service.pdbPDB path embedded in BadIIS service installer; Chinese text translates to xshen self-installation service
- filenameC:\Users\iis\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\widestring-1.2.1\src\ucstring.rsRust crate source path embedded in RustPotato binary, indicating compilation on a machine with username iis and the widestring crate installed
- filenameC:\Users\iis\Desktop\AI\EfsPotatoCpp\x64\Release\EfsPotato.pdbPDB path for custom-compiled EfsPotato privilege escalation tool, showing AI directory in build path suggesting AI-assisted development
- filenameC:\Users\Intel\Desktop\AI\EfsPotatoCPP\x64\Debug\EfsPotato.pdbPDB path for debug build of EfsPotato, showing AI directory in build path on a machine with username Intel
- filenameC:\Windows\System32\drivers\etc\hosts:cacheNTFS alternate data stream on the Windows hosts file used by SPECTRE to store and update C2 configuration, allowing firewall bypass without recompilation
- filenameDBUtil_2_3.sysVulnerable Dell driver dropped to %TEMP% and loaded as kernel service for BYOVD EDR neutralization via CVE-2021-21551
- filenamehardware-monitor.serviceFraudulent systemd unit file used by Specter rootkit for persistence, configured with Before=sysinit.target to execute before security tooling on boot
- filenameRTCore64.sysVulnerable MSI driver dropped to %TEMP% and loaded as kernel service for BYOVD EDR neutralization via CVE-2019-16098
Detection / Hunteropenrouter
What Happened
A Chinese-speaking hacking group called UAT-10147 has been found using a new malware tool called SPECTRE that works on both Windows and Linux servers. The tool can disable security software by loading known-vulnerable driver files, steal passwords from web browsers and Windows credential storage, and hide itself using a Linux kernel rootkit component. The group also manipulates search engine rankings for fraud, specifically targeting Vietnamese internet users through the Coc Coc browser. Evidence suggests the attackers may be using artificial intelligence to help write their malware code. Organizations running internet-facing Windows or Linux servers should review their security logs, block known-vulnerable drivers, and check for unexpected kernel modules or system services.
Key Takeaways
- UAT-10147 deploys SPECTRE, a cross-platform backdoor written in C with 45 commands on Windows and 29 on Linux
- SPECTRE includes BYOVD-based EDR neutralization using RTCore64.sys (CVE-2019-16098) and DBUtil_2_3.sys (CVE-2021-21551) to unlink kernel callbacks from PspCreateProcessNotifyRoutine, PspCreateThreadNotifyRoutine, and PspLoadImageNotifyRoutine
- Specter Linux rootkit uses ftrace with FTRACE_OPS_FL_IPMODIFY to hook six syscall handlers and is disguised as acpi_pad.ko with systemd persistence via hardware-monitor.service configured with Before=sysinit.target
- Cisco Talos assesses with medium confidence that AI-assisted development was used for both SPECTRE and Specter rootkit based on documentation structure, decorative separator uniformity, and exhaustive multi-method code presentation
- Campaign includes SEO fraud utilities targeting Vietnamese users via Coc Coc browser and multiple commodity backdoors including Gh0stCringe, QuasarRAT, Meterpreter, and Noodle RAT
Affected Systems
- IIS servers (Windows)
- Linux servers (x86-64)
- Google Chrome browser (credential theft target)
- Microsoft Edge browser (credential theft target)
- Coc Coc browser (targeted by ASHX SEO engine)
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2019-16098 | MSI Afterburner RTCore64.sys driver | High | Arbitrary kernel memory read/write through the RTCore64.sys driver, exploited for BYOVD EDR neutralization |
| CVE-2021-21551 | Dell DBUtil_2_3.sys driver | High | Arbitrary kernel memory read/write through the Dell DBUtil driver, exploited for BYOVD EDR neutralization |
Attack Chain
- Initial Access: Compromise of internet-facing IIS and Linux servers via exploitation and SEO fraud deployment
- Execution: Deploy web shell with in-memory CodeDomProvider compilation, BadIIS MaaS, and ASHX SEO engine for Vietnamese user targeting
- Privilege Escalation: Use Potato family tools (GodPotato, JuicyPotato, EfsPotato, RustPotato) and BYOVD with RTCore64.sys or DBUtil_2_3.sys to gain kernel access
- Defense Evasion: Unlink EDR kernel callbacks via BYOVD, process hollowing into svchost.exe or RuntimeBroker.exe, anti-sandbox scoring, API hashing via DJB2, and string encryption via xorshift32 PRNG
- Persistence: Deploy SPECTRE backdoor with C2 config in NTFS ADS, Specter rootkit as acpi_pad.ko with hardware-monitor.service, and commodity backdoors (Gh0stCringe, QuasarRAT, Meterpreter, Noodle RAT)
- C2 and Credential Theft: SPECTRE beacons to udvyiwvfs.cyou over HTTPS; dumps SAM/SYSTEM/SECURITY hives, Chrome/Edge login data, and Windows Credential Manager entries
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: Yes
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: ClamAV, Snort2, Snort3
ClamAV signatures and Snort rules are provided for detecting SPECTRE, Specter rootkit, and associated components. Snort2 SIDs include 1:66690, 1:66688, 1:66689. Snort3 SIDs include 1:66690, 1:301548. ClamAV signatures cover Windows malware, Unix rootkit, and tool-related detections. Additional IOCs are available in a referenced GitHub repository.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | SPECTRE targets EDR via BYOVD and kernel callback unlinking, which blinds kernel-callback-dependent EDR products after execution. Initial deployment, driver loading, and pipe creation stages may generate telemetry before EDR is neutralized. The BYOVD EDR kill specifically targets CrowdStrike, SentinelOne, Microsoft Defender, and other callback-based EDR vendors. |
| Network Visibility | Medium | C2 communications use HTTP POST to specific endpoints on udvyiwvfs.cyou over port 443. Network monitoring can detect these connections, but the traffic mimics legitimate HTTPS with a standard Chrome user-agent string. DNS resolution of the .cyou domain may also be detectable. |
| Detection Difficulty | Hard | SPECTRE uses DJB2 API hashing, per-string xorshift32 encryption, anti-sandbox scoring with a 50-point threshold, and process hollowing to evade detection. The BYOVD EDR kill neutralizes kernel callbacks. The Linux rootkit uses ftrace which produces minimal noise in kernel integrity checks. String encryption prevents static analysis of command names in the .text and .rdata sections. |
Required Log Sources
- Windows Sysmon events (process creation, driver loading, pipe creation, file stream creation)
- Windows Event Logs (Security, System)
- Network proxy and firewall logs
- DNS resolution logs
- Linux auditd logs
- Linux systemd journal logs
- Kernel module loading logs (dmesg, /proc/modules)
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for network connections to udvyiwvfs.cyou or its subdomains over port 443, which would indicate SPECTRE C2 activity | Proxy logs, firewall logs, DNS resolution logs | C2 | Low — the domain is specific to this campaign and unlikely to appear in legitimate traffic |
| Consider hunting for processes opening device handles to \.\RTCore64 or \.\DBUtil_2_3, which indicate BYOVD activity targeting kernel read/write primitives | Sysmon Event ID 10 (file access), EDR process handle events | Defense Evasion | Low — these are known vulnerable driver device paths not typically accessed by standard applications |
| Consider hunting for Linux kernel modules named acpi_pad.ko loaded from non-standard paths or with hash mismatches against the legitimate module | Linux auditd logs, lsmod output, kernel module integrity checks, dmesg | Persistence | Medium — acpi_pad.ko is a legitimate kernel module name; hash or path verification is required to distinguish the rootkit from the real module |
| Consider hunting for systemd services named hardware-monitor.service with Before=sysinit.target configuration, which would indicate Specter rootkit persistence | systemd journal logs, systemctl output, unit file enumeration | Persistence | Low — the specific service name combined with the Before=sysinit.target directive is distinctive |
| Consider hunting for NTFS alternate data streams on C:\Windows\System32\drivers\etc\hosts, specifically the cache stream used by SPECTRE for C2 config storage | Sysmon Event ID 15 (file stream creation), NTFS alternate data stream enumeration | C2 Configuration | Low — alternate data streams on the Windows hosts file are not standard system behavior |
Control Gaps
- Signature-based antivirus may miss SPECTRE due to DJB2 API hashing and xorshift32 string encryption that prevent static string matching in .text and .rdata sections
- Kernel callback-based EDR products lose visibility after BYOVD EDR kill unlinks PspCreateProcessNotifyRoutine, PspCreateThreadNotifyRoutine, and PspLoadImageNotifyRoutine entries
- Network-based detection may be limited if C2 traffic uses standard Chrome user-agent and HTTPS to a .cyou domain
- ftrace-based rootkit hooks produce minimal noise in kernel integrity checks, potentially evading kernel integrity monitoring tools
- Anti-sandbox scoring with 50-point threshold may prevent detonation in automated sandbox environments by checking process name blocklists, RAM, CPU cores, disk space, sleep acceleration, and sandbox hostnames
Key Behavioral Indicators
- Network connections to udvyiwvfs.cyou over port 443 with POST requests to /api/v1/register or /api/v1/output endpoints
- Device handle creation to \.\RTCore64 or \.\DBUtil_2_3 from non-standard processes followed by IOCTL operations
- Named pipe creation matching \.\pipe\spectre_* pattern for SYSTEM token impersonation
- Driver service installation in %TEMP% for RTCore64.sys or DBUtil_2_3.sys via SCM API
- Linux kernel module acpi_pad.ko loaded from non-standard path or with hash mismatch against legitimate module
- systemd service hardware-monitor.service with description Hardware Performance Monitor and Before=sysinit.target
- kill() syscall targeting PID 31337 (0x7A69) with real-time signals 35, 36, 37, or 62 on Linux for rootkit IPC
- Web shell authentication via X-ID HTTP header with value x9 or v parameter with value x9
- Process hollowing of svchost.exe or RuntimeBroker.exe from unexpected parent processes
- ASHX handler class named SeoEngineHandler in IIS request pipeline with X-seo configuration string
- RegSaveKeyA operations targeting HKLM\SAM\SAM, HKLM\SYSTEM, or HKLM\SECURITY from non-standard processes
False Positive Assessment
Low — the C2 domain, PDB paths, and systemd service name are highly specific to this campaign. The acpi_pad.ko filename is a legitimate kernel module name, but hash verification or path analysis eliminates false positives. The X-ID header value x9 and device paths are low-volume indicators that are unlikely to appear in normal operations.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking the C2 domain udvyiwvfs.cyou at your firewall, proxy, and DNS filtering infrastructure.
- Consider enabling Microsoft's Vulnerable Driver Blocklist or your EDR vendor's equivalent driver blocklist feature to prevent loading of RTCore64.sys and DBUtil_2_3.sys, if supported by your platform.
- If you operate internet-facing IIS or Linux servers, consider auditing them for unexpected web shells, ASHX handlers, or recently deployed kernel modules matching the indicators described.
Infrastructure Hardening
- Consider implementing Linux kernel module signing enforcement on Linux servers to prevent loading of unsigned rootkit modules such as the Specter rootkit disguised as acpi_pad.ko.
- Evaluate monitoring systemd unit files for services configured with Before=sysinit.target that do not correspond to known legitimate services.
- Consider restricting outbound connections from server infrastructure to newly registered or suspicious TLDs such as .cyou where applicable.
- If applicable to your Windows environment, evaluate deploying Windows Defender Application Control (WDAC) policies to block unauthorized driver installation.
User Protection
- Consider deploying endpoint detection rules for processes opening device handles to \.\RTCore64 or \.\DBUtil_2_3, which indicate BYOVD activity.
- Evaluate enabling alerts for RegSaveKeyA operations targeting SAM, SYSTEM, or SECURITY registry hives from non-standard processes.
- If your EDR supports browser credential access monitoring, consider enabling alerts for processes accessing Chrome or Edge login data files outside of normal browser execution.
Security Awareness
- Consider incorporating awareness of SEO fraud and compromised web server scenarios into existing security training programs.
- Evaluate briefing server administration teams on indicators of BadIIS and ASHX SEO engine compromise, including the SeoEngineHandler class name and X-seo configuration string.
- If your organization serves Vietnamese markets, consider heightened monitoring for campaigns targeting the Coc Coc browser and vn.xyz C2 domain suffixes.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping17 techniques
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Credential Access
Additional IOCs
- Urls:
udvyiwvfs.cyou/api/v1/register- SPECTRE C2 registration endpoint, receives POST requests with system info JSON payload during initial beaconudvyiwvfs.cyou/api/v1/output- SPECTRE C2 output endpoint, receives POST requests containing command execution results
- File Paths:
C:\Users\Administrator\Desktop\2025-11-21 (x神订制全站劫持按浏览器语言跳转)\dll\Release\demo.pdb- PDB path embedded in BadIIS malware linking to developer xshen; Chinese text translates to xshen custom full-site hijack redirect by browser languageC:\Users\Administrator\Desktop\2025-11-21 (x神订制全站劫持按浏览器语言跳转)\dll\x64\Release\demo.pdb- PDB path embedded in 64-bit BadIIS malware variant linking to developer xshenC:\Users\Administrator\Desktop\x神的自安装服务\svchost\x64\Release\service.pdb- PDB path embedded in BadIIS service installer; Chinese text translates to xshen self-installation serviceC:\Users\iis\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\widestring-1.2.1\src\ucstring.rs- Rust crate source path embedded in RustPotato binary, indicating compilation on a machine with username iis and the widestring crate installedC:\Users\iis\Desktop\AI\EfsPotatoCpp\x64\Release\EfsPotato.pdb- PDB path for custom-compiled EfsPotato privilege escalation tool, showing AI directory in build path suggesting AI-assisted developmentC:\Users\Intel\Desktop\AI\EfsPotatoCPP\x64\Debug\EfsPotato.pdb- PDB path for debug build of EfsPotato, showing AI directory in build path on a machine with username Intel
- Command Lines:
- Purpose: Enumerate Windows Credential Manager entries without LSASS access | Tools:
cmdkey.exe| Stage: Credential Theft |cmdkey.exe /list
- Purpose: Enumerate Windows Credential Manager entries without LSASS access | Tools:
- Other:
\\.\RTCore64- Windows device path opened by SPECTRE to interact with RTCore64.sys driver for kernel read/write operations during BYOVD EDR neutralization\\.\DBUtil_2_3- Windows device path opened by SPECTRE to interact with DBUtil_2_3.sys driver for kernel read/write operations during BYOVD EDR neutralization\\.\pipe\spectre_<tid>- Named pipe created by SPECTRE for SYSTEM token acquisition via ImpersonateNamedPipeClient; tid is a dynamic thread identifier
