Chinese-Speaking Cybercrime Group UAT-10147 deploys AI-Augmented Server Attacks with SPECTRE Exploit and Linux Rootkit

Researchers from a cybersecurity firm have identified activity attributed to UAT-10147, a Chinese-speaking cybercrime group targeting web servers worldwide. The group's infrastructure and tooling were uncovered via an open repository, revealing a suite of capabilities designed to compromise both Windows and Linux environments. Key aspects of the reported activity include the use of artificial intelligence to augment and scale attack operations, exploitation of the SPECTRE vulnerability to bypass Endpoint Detection and Response (EDR) protections, and the deployment of a Linux rootkit to maintain persistent access to compromised systems. The primary targets have been identified in Brazil, Bolivia, China, Canada, and Vietnam, spanning sectors such as education, media, technology, and gaming. While the reports indicate a sophisticated approach leveraging AI and known exploits, the precise technical mechanics of the AI-driven scaling and the specific EDR bypass methods require further validation from original research sources. As of now, no specific vendor patches have been issued exclusively for this campaign, though general security best practices such as patching systems, updating EDR solutions, and monitoring for Indicators of Compromise (IoCs) are recommended.