UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

Cisco Talos attributes a sophisticated multi-platform campaign to a Chinese-speaking intrusion actor (UAT-10147) that uses a C-based cross-platform backdoor called SPECTRE and a kernel-level Linux rootkit (Specter) to achieve persistence, credential theft, process injection, and BYOVD EDR neutralization; the actor also employs SEO fraud tools (BadIIS, ASHX), Potato-family privilege escalation, multiple commodity RATs, and provides IOCs and detection signatures.