Chinese-Speaking Cybercrime Group Leverages AI-Driven Tooling for Complex Attacks

Cisco Talos has identified a Chinese-speaking cybercrime group, tracked as UAT-10147, that targets vulnerable web servers globally. The group engages in multiple criminal activities, including search engine optimization (SEO) fraud and data theft.

The actor leverages publicly disclosed vulnerabilities to gain initial access at scale and integrates AI-driven tooling into exploitation, reconnaissance, payload generation, validation, and persistence workflows. Talos observed AI-generated operational playbooks, exploit automation scripts, and troubleshooting logic supporting real-world intrusions.

UAT-10147 employs a mixture of open-source offensive frameworks, including Metasploit, ysoserial, PentestGPT, DeepAudit, and multiple privilege escalation exploits to automate intrusion operations and establish persistence. Talos assesses that integrating AI-generated exploitation guidance, automation, and validation workflows enables threat actors to scale complex attacks more efficiently while reducing the expertise traditionally required for advanced post-compromise operations.