You've probably seen the headlines by now—"Chinese hackers use AI to automate attacks," "170,000 servers compromised," "DeepSeek-powered cyberattacks." The news cycle has been buzzing. But between the clickbait and the panic, what actually happened? And why should anyone running a web server care?
Let's cut through the noise.
What Cisco Talos Actually Found
On August 20, Cisco Talos published its investigation into UAT-10147, a Chinese-speaking, financially motivated cybercrime group. The group wasn't using AI to invent zero-day exploits or do anything magical. What they were doing was more practical—and arguably more dangerous.
Talos recovered an exposed staging server that belonged to the attackers. Inside? A target list of roughly 170,000 URLs across government agencies, universities, media outlets, technology firms, and gaming companies in Brazil, Bolivia, China, Canada, and Vietnam. The list was split into 17 files of about 10,000 URLs each—a sign of organized, industrial-scale targeting.
But the real story isn't the target list. It's how they planned to work through it.
AI as a Force Multiplier
UAT-10147 integrated AI-driven tools directly into their attack workflow: PentestGPT (an AI penetration-testing assistant), DeepAudit (a source-code vulnerability scanner), and AI-generated exploitation playbooks.
Think about what that means. Instead of a human operator manually testing each target, writing scripts, debugging failures, and moving to the next, the AI handled the repetitive grind. One recovered session showed the operator providing only an initial objective—then the AI agent completed the remaining steps independently.
The agent researched vulnerabilities, identified targets through the FOFA search engine, downloaded public exploits, and attempted exploitation—all in minutes. What would normally take hundreds of hours of manual work got compressed into an automated pipeline.
As one analysis put it: "Agentic AI here is not replacing strategic decision-making—it's compressing the time spent on repetitive tasks. Reading targets, selecting scripts, interpreting failures, rewriting parameters, checking results, and queuing the next round of actions".
The Toolbox: SPECTRE and BadIIS
Beyond the AI layer, UAT-10147 deployed some serious hardware.
SPECTRE is a cross-platform implant that works on both Windows IIS and Linux servers. It delivers kernel-level rootkits, process-injection backdoors, credential theft capabilities, and a BYOVD (Bring Your Own Vulnerable Driver) technique that blinds EDR solutions like CrowdStrike Falcon and SentinelOne. On Linux, it uses a rootkit called Specter that hides via the ftrace instrumentation framework. Talos assessed with medium confidence that portions of the rootkit's development used AI-assisted code generation.
BadIIS is the monetization engine. This IIS-focused malware redirects traffic, manipulates crawler responses, hijacks content, injects backlinks, and uses reverse-proxy capabilities to influence search rankings—SEO fraud, plain and simple.
Initial access came from exploiting publicly known vulnerabilities: Zimbra CVE-2022-27925, AjaxPro CVE-2021-23758, Nacos CVE-2021-29441 and CVE-2021-29442, and Telerik UI CVE-2019-18935. Nothing zero-day. Nothing exotic. Just old flaws, automated at scale.
The DeepSeek Connection
A separate but related campaign, documented by Palo Alto Networks' Unit 42, involved a threat actor using DeepSeek through the Hermes Agent framework. The AI was configured to operate in "Yolo" mode—executing risky commands without requesting permission.
The actor used DeepSeek as the reasoning engine behind Hermes, which could interact with operating system terminals, run commands, browse the internet, and integrate with the FOFA search engine. In one session, the agent identified over 647,000 exposed n8n instances through FOFA, downloaded exploits, and attempted compromises—all autonomously.
The autonomous attacks ultimately failed because the required upload forms needed authentication. But that's not the point. The workflow worked. The AI independently researched vulnerabilities, selected targets, retrieved exploit code, and attempted exploitation without human intervention. The researchers confirmed it was "a functional, end-to-end autonomous offensive capability".
What This Means for Defenders
Here's the uncomfortable truth: AI isn't making attacks more sophisticated. It's making existing attacks cheaper and faster.
The vulnerabilities UAT-10147 exploited were all publicly known. Some dated back to 2019. The AI didn't discover new flaws—it just removed the friction from exploiting old ones at scale.
For defenders, this shifts the game. You can't rely on attackers being slowed down by manual processes anymore. As one analysis noted, detection should move from "looking for malicious strings" to "watching for task state machines"—patterns of behavior: the same target accessed by different tools in a fixed order, parameters rewritten within seconds after a response changes, reconnaissance rapidly followed by validation attempts.
Patch your known vulnerabilities. Monitor for automation patterns, not just known signatures. And understand that the barrier to running large-scale attacks just got lower.
The Bottom Line
UAT-10147 isn't a state-sponsored APT. It's a financially motivated crime group. And they're using AI to operationalize offensive tradecraft at a scale once associated primarily with nation-states.
The AI isn't doing the thinking. It's doing the work. And that's what makes this campaign a milestone—not because the attacks succeeded, but because the pipeline worked.
Tags:
Technology