Introduction
UAT-10147 is a Chinese-speaking, financially motivated threat actor targeting internet-facing Windows and Linux servers through the exploitation of publicly disclosed vulnerabilities. The group employs advanced techniques including AI-assisted workflows, deploying malware such as SPECTRE and various RATs, and utilizing capabilities like remote code execution and privilege escalation. Their operations are characterized by the integration of AI for reconnaissance, exploit refinement, and persistent access management. UAT-10147 has a target list of approximately 170,000 URLs and impacts various sectors, including government and education.
Activities and Tactics
Country of Origin: 🇨🇳 China
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
Information pending cataloguing.
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- RemoteCMD:
- Remote Utilities:
- Windows Remote Desktop:
- RemotePC:
- Xploit:
Attribution and Evidence
Country of Origin: China Additional attribution information pending cataloguing.
References
References pending cataloguing.
Recent News
Latest articles from security news feeds mentioning this actor.
- UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit The Hacker News — 2026-08-24