UAT-10147 Deploys SPECTRE Implant with Advanced Linux Rootkit Capabilities
The Chinese-speaking intrusion actor known as UAT-10147 has deployed SPECTRE, a cross-platform implant with Linux rootkit and BYOVD capabilities. This implant is part of a multi-platform post-exploitation ecosystem that targets IIS and Linux servers, combining search engine optimization (SEO) fraud monetization with advanced persistence and defense evasion techniques.
The actor demonstrates operational maturity through the combined use of custom malware, open-source offensive tooling, BYOVD-based EDR neutralization, Linux kernel rootkits, and sophisticated in-memory web shell deployment techniques. Cisco Talos' analysis of recovered source code suggests portions of the Linux rootkit development may have incorporated AI-assisted code generation workflows.
SPECTRE is a cross-platform backdoor written in C that exhibits indications of AI-assisted development. It has custom post-exploitation and defense evasion capabilities compiled directly into the binary, prioritizing obfuscation and anti-analysis through dual layered defense strategies.
The implant features a weighted anti-analysis scoring routine that evaluates process name blocklists, RAM capacity, CPU core count, disk space, sleep acceleration detection, and common sandbox host names and usernames. If the cumulative score reaches or exceeds 50 points, the process self-terminates.