UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations

Cisco Talos describes UAT-10147, a Chinese-speaking cybercrime group leveraging AI-driven tools and public one-day vulnerabilities to scale cross-platform compromises of internet-facing web servers (Windows and Linux), deploying implants such as BadIIS and SPECTRE for SEO fraud and data theft; the report includes detailed attack chains, AI-generated exploit/playbook artifacts, exploited CVEs, persistence and privilege-escalation methods, a ~170,000-URL target list, observed IOCs, and detection signatures.