UAT-10147 Uses SPECTRE for Cross-Platform Persistence and Evasion

Summary

UAT-10147 is a Chinese-speaking threat actor operating a sophisticated multi-platform post-exploitation ecosystem. Its toolkit includes the SPECTRE cross-platform backdoor, the Specter Linux rootkit, and SEO fraud tools such as BadIIS. The actor also uses advanced techniques including Bring Your Own Vulnerable Driver (BYOVD) to disable EDR protections and incorporates AI-assisted development workflows.

Investigation

Cisco Talos analyzed recovered source code and malware samples to trace the evolution of UAT-10147’s tooling. The investigation identified signs of AI-assisted code generation within the Linux rootkit and distinctive development artifacts in the BadIIS malware. Researchers also documented the SPECTRE implant’s command structures, injection techniques, and kernel-level defense evasion capabilities.

Mitigation

Organizations should harden internet-facing IIS and Linux servers and monitor for deployment of known vulnerable drivers such as RTCore64.sys and DBUtil_2_3.sys. Strong EDR configurations should be enforced, with monitoring for unauthorized kernel module loading and suspicious systemd service creation. Web server defenses should also include auditing for unauthorized ASHX handlers and unexpected HTTP headers such as X-ID.

Response

If UAT-10147 activity is detected, compromised IIS or Linux servers should be isolated immediately to limit lateral movement. Responders should conduct forensic analysis of kernel integrity and search for unauthorized NTFS Alternate Data Streams. System logs should also be reviewed for suspicious service installations and potential credential theft through registry hive dumping or credential manager enumeration.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has gained initial access via a web vulnerability. To establish deep persistence and evade detection, they intend to deploy a rootkit. The attacker first spawns a shell to stabilize their session. They then run ps to see if any security monitoring processes are running. Finally, they use insmod to load a dummy kernel module, mimicking the SPECTRE variant’s method of altering kernel behavior for remote control.

• Regression Test Script:

  #!/bin/bash
  # SPECTRE Linux Variant Simulation Script
  
  echo "[+] Starting SPECTRE Linux Variant Simulation..."
  
  # 1. Simulate Shell Execution (selection_shell)
  echo "[+] Step 1: Executing shell command..."
  /bin/sh -c "echo 'Shell access established'"
  
  # 2. Simulate Process Discovery (selection_ps)
  echo "[+] Step 2: Performing process discovery..."
  ps -ef | grep "simulation"
  
  # 3. Simulate Kernel Module Loading (selection_kernel_module)
  # Note: This requires sudo. We will attempt to load a dummy module or simulate the command.
  # To avoid crashing the system, we will use a non-existent module name 
  # which still generates the 'insmod' command line telemetry.
  echo "[+] Step 3: Attempting to load kernel module via insmod..."
  sudo insmod spectre_rootkit_test.ko || echo "[!] insmod failed as expected (module not found), but telemetry should be generated."
  
  echo "[+] Simulation complete."

• Cleanup Commands:

  # Cleanup is minimal as we used a non-existent module name to avoid system instability.
  # If a real module was loaded, use:
  # sudo rmmod spectre_rootkit_test
  echo "[+] Cleanup: No persistent changes made to the kernel."