UAT-10147 Uses Agentic AI to Expand Post-Compromise Activity

Summary

UAT-10147 is a Chinese-speaking cybercrime group using agentic AI to automate and scale post-compromise operations. The actor targets Windows and Linux web servers for SEO fraud and data theft. Its AI-driven tooling supports exploit refinement, reconnaissance, and payload generation, reflecting a broader shift toward semi-autonomous attack orchestration.

Investigation

Cisco Talos identified the activity after observing a compromised system communicating with a C2 download server. The investigation uncovered an exposed directory containing a target list of approximately 170,000 URLs and evidence of AI-generated operational playbooks. Analysts also reconstructed distinct infection chains targeting both Windows and Linux environments.

Mitigation

Organizations should protect the confidentiality of ASP.NET MachineKeys and keep exposed software updated against known RCE vulnerabilities. Strict egress filtering and monitoring for anomalous PowerShell or certutil activity are recommended. Security teams should also regularly audit Windows Defender exclusion lists for unauthorized changes affecting critical system directories.

Response

If UAT-10147 activity is detected, affected web servers should be isolated immediately and analyzed for malicious batch scripts and web shells. Responders should review recent Windows Defender exclusion changes and scheduled task creation. IIS configurations should also be validated, and systems checked for unauthorized local user accounts created during the intrusion.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has gained initial access to a web server. To facilitate lateral movement and data exfiltration, they first perform reconnaissance to understand the IIS web structure using appcmd. Following this, to ensure their toolkit remains undetected during the next phase of the operation, they attempt to disable security controls by adding a path exclusion to Windows Defender using cmd.exe to wrap the reg command.

• Regression Test Script:

  # Simulation Script for Detection Validation
  # Note: This script requires Administrative privileges to modify registry.
  
  Write-Host "[+] Starting Simulation..." -ForegroundColor Cyan
  
  # 1. Simulate IIS Reconnaissance (T1105 precursor)
  Write-Host "[+] Executing IIS appcmd reconnaissance..." -ForegroundColor Yellow
  Start-Process "cmd.exe" -ArgumentList "/C C:Windowssystem32inetsrvappcmd list site /config /xml" -Wait
  
  # 2. Simulate Defender Evasion via Registry (T1564.012)
  Write-Host "[+] Executing Defender Registry modification..." -ForegroundColor Yellow
  Start-Process "cmd.exe" -ArgumentList '/C reg add "HKLMSOFTWAREMicrosoftWindows DefenderExclusionsPaths" /v "C:Temp" /t REG_SZ /d "C:Temp" /f' -Wait
  
  Write-Host "[+] Simulation Complete." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup Script
  Write-Host "[+] Cleaning up registry modifications..." -ForegroundColor Cyan
  
  # Remove the added registry key/value
  reg delete "HKLMSOFTWAREMicrosoftWindows DefenderExclusionsPaths" /v "C:Temp" /f
  
  Write-Host "[+] Cleanup Complete." -ForegroundColor Green