UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

Recent reports from Cisco Talos Blog, The Hacker News, CyberInsider, gbhackers.com, and cyberpress.org detail a newly tracked threat activity cluster identified as UAT-10147. According to the coverage, this Chinese-speaking adversary is actively using artificial intelligence tools, specifically DeepSeek and Hermes Agent, to scale and automate cyberattacks targeting servers. Meanwhile, details published by The Hacker News indicate that the malicious operations involve deploying a tool known as SPECTRE, which features an endpoint detection and response, or EDR, bypass alongside a Linux rootkit. Additional reporting from gbhackers.com and cyberpress.org emphasizes the specific mechanics of the campaign, noting the integration of agentic AI into post-compromise operations. The coverage highlights how the adversary utilizes these advanced AI models to execute vulnerability exploitation autonomously.

Cisco Talos Blog first designated the threat actor as UAT-10147, framing the campaign around the use of agentic AI in post-compromise phases. The outlets uniformly point to the intersection of automated workflows, machine learning systems, and traditional backdoor installation techniques as the primary vectors of concern in this developing trend. This trend emerges as a significant development in threat intelligence regarding the operational use of publicly available or specialized large language models in malicious campaigns. While previous threat actors have experimented with AI for basic phishing or reconnaissance tasks, the coverage of UAT-10147 illustrates a shift toward agentic AI handling complex post-compromise maneuvers and autonomous exploitation. Outlets such as The Hacker News and Cisco Talos Blog provide technical context regarding the use of custom payloads like SPECTRE, showing that advanced evasion tactics continue to accompany automated tooling in targeted enterprise and server environments.

As the situation unfolds, security analysts and observers will monitor further disclosures regarding the full extent of the server targeting and the specific capabilities of the Hermes Agent integration. Coverage does not yet specify the total number of compromised entities beyond the broad scale reported, nor does it detail official remediation timelines or government responses. Future updates from the reporting outlets are expected to track the technical evolution of UAT-10147, the efficacy of the deployed Linux rootkits, and any additional infrastructure utilized by the Chinese-speaking threat actor in subsequent campaigns.