Talos published the findings on August 20 after tracing activity to an exposed attacker download server and recovering operational material tied to the campaign. The group reportedly targeted internet-facing servers in government, education, media, technology and gaming organizations, with confirmed victim infrastructure in Brazil, Bolivia, Canada, China and Vietnam. Talos also found a list of roughly 170,000 target URLs, broken into batches of about 10,000 for scanning.
The important finding is that the recovered material documents an intrusion workflow with testing, troubleshooting and fallback paths—not simply a threat actor asking a chatbot to write a one-off script. But the evidence also sets a necessary limit on the “agentic AI” label: Talos describes AI-assisted operational documentation, Python automation, validation logic and use of PentestGPT, rather than an independently observed autonomous system that selected targets and ran an entire campaign without an operator. The immediate defensive response should therefore focus on the familiar entry points and Windows persistence changes the automation makes easier to repeat.
The Windows chain aims for IIS control and durable remote access
According to Talos, once UAT-10147 has remote code execution or another foothold on a Windows web server, its main staging script downloads an EfsPotato privilege-escalation tool, a follow-on batch file and a QuasarRAT payload masquerading as svchosts.exe. The script then attempts to elevate privileges, deletes staging material and modifies Microsoft Defender settings.
The most operationally significant step is the reported addition of C:\Windows\System32\inetsrv and C:\Windows\SysWOW64\inetsrv to Microsoft Defender Antivirus exclusions. Those directories are where IIS tooling and components reside. Microsoft’s own documentation confirms that Add-MpPreference -ExclusionPath can exclude a directory from both scheduled and real-time scans, so a successful change creates a meaningful blind spot precisely where an IIS-focused attacker expects to place a malicious module.
Talos says the actor subsequently uses appcmd to enumerate IIS sites and configuration, downloads a BadIIS package, and launches a script that creates a rogue local account in both the local Administrators and Remote Desktop Users groups. The group’s secondary script reportedly creates the “Google Chrome Start” task to launch its backdoor at user logon with highest privileges.
This is a layered persistence design. A defender who removes only a suspicious executable could leave behind a local RDP-capable administrator, an IIS-resident implant, a scheduled task, or an antivirus exclusion that lets the actor return with a replacement payload. The incident should be handled as a server compromise, not a malware-cleanup ticket.
AI reduced friction in a known ASP.NET attack path
Talos’s most useful technical evidence is an AI-generated operational guide and companion scripts built around ASP.NET ViewState deserialization. The documents reportedly cover verification of stolen or leaked ASP.NET MachineKey material, payload preparation through ysoserial, out-of-band execution confirmation, IIS reconnaissance, web-shell deployment and privilege-escalation options.
The report makes clear that this pathway still depends on exposed secret material. An attacker needs the relevant validation and decryption keys, their algorithms, the target URL and the ViewState generator value. Microsoft documentation describes MachineKey values as security material used in forms authentication and ViewState validation, and explains that the ViewState MAC exists to stop clients from submitting maliciously changed state. In other words, the automation makes an established failure mode easier to exercise; it does not bypass the basic requirement that the application’s key material be available or improperly managed.
Talos found that the actor used response behavior to validate key material before undertaking noisier action. Its recovered guide treated a particular HTTP 500 response containing an InvalidCastException as a positive sign that deserialization had occurred. That has a practical monitoring consequence: a large number of server errors should not be dismissed as routine application instability when they cluster around ViewState-bearing requests, particularly on public-facing legacy ASP.NET applications.
Microsoft recommends keeping ViewState MAC protection enabled. Administrators should also treat web.config, deployment archives, source repositories, backups and CI/CD artifacts as potential secret-exposure routes. Static MachineKey values may be required for web farms, but they must be unique, protected as credentials, and rotated when exposure is suspected. A copied key from a sample configuration, a public repository, or a reused application template can convert a niche legacy weakness into a remotely testable attack surface.
“Agentic” is the scaling claim, not the initial-access claim
Talos assessed with moderate-to-high confidence that UAT-10147 belongs to an emerging group of financially motivated operators using agentic AI to scale offensive tradecraft. It observed the PentestGPT framework on the attacker’s command-and-control infrastructure and says it was used to scan web servers and execute relevant proof-of-concept exploits. It also found DeepAudit installed, although Talos explicitly says it did not directly observe exploitation of a vulnerability found by that framework.
That distinction deserves attention. The public record supports the presence of AI-oriented tooling and AI-generated artifacts in a real intrusion environment. It does not establish that DeepAudit-generated discoveries led to victim compromises, and no independent outlet had published detailed corroboration of Talos’s timeline or its “emerging class” assessment at publication time. Talos’s exposed-server evidence is substantial, but its attribution and the broader claim about a new operating model remain vendor analysis.
What the recovered material does show is a more consequential shift than automated scanning alone. The scripts reportedly test whether a server can write to a webroot, collect access-control information, identify virtual-directory mappings, try alternatives if certutil fails, and poll a web callback service for results. These are the small operator decisions that consume time and cause failed intrusions. Packaging them into reusable, documented workflows allows a criminal operation to process more targets while relying less on a highly skilled person to debug every incompatible server.
The target list reinforces the point. Breaking 170,000 URLs into 17 chunks is not sophisticated by itself. Combined with automated validation and deployment steps, it describes an operation designed around volume and recovery from failure.
Old flaws remain the opening UAT-10147 needs
The campaign’s initial-access methods remain overwhelmingly conventional. Talos lists exploitation of publicly disclosed vulnerabilities including CVE-2022-27925 in Zimbra Collaboration Suite, CVE-2021-23758 in AjaxPro, CVE-2021-29441 and CVE-2021-29442 affecting Nacos, and CVE-2019-18935 in Telerik UI for ASP.NET AJAX.
There is a material correction to make to the description of CVE-2022-27925: CISA’s prior advisory says the Zimbra flaw is an authenticated arbitrary-file-upload issue and was widely exploited alongside CVE-2022-37042, an authentication bypass that enables unauthenticated access to the vulnerable endpoint. Organizations should not model CVE-2022-27925 as a standalone unauthenticated remote-code-execution flaw. The practical outcome is the same for unpatched or exposed Zimbra deployments: patching and exposure reduction are urgent, but accurate vulnerability chaining matters during incident triage and threat hunting.
On Linux, Talos observed the group deploying web shells and trying a collection of local privilege-escalation exploits, including Dirty Pipe and Baron Samedit, before installing implants such as NoodleRAT, SPECTRE or Meterpreter. That reinforces the core finding: AI is helping operationalize post-compromise work, while old unpatched application and kernel weaknesses still supply the foothold.
What Windows and IIS teams should check now
Organizations running public IIS, legacy ASP.NET Web Forms, Telerik UI, AjaxPro, Nacos components, or other web applications with a history of deserialization flaws should prioritize exposure review and compromise assessment over generic AI-blocking measures. There is no indication in Talos’s report that blocking access to a particular model provider would stop this operation; the payloads execute locally on the compromised server.
A focused review should include the following actions:
- Review Microsoft Defender Antivirus exclusions on internet-facing Windows servers, especially the IIS directories
System32\inetsrvandSysWOW64\inetsrv, and investigate any unexplained recent changes rather than simply removing them. - Confirm Defender tamper protection is enabled and centrally managed where supported. Microsoft says tamper-protection events can generate alerts in the Defender portal, and exclusion protections should be verified rather than assumed.
- Hunt for scheduled tasks named “Google Chrome Start,” unexpected local accounts in Administrators or Remote Desktop Users, and new executables or archives staged under
C:\ProgramData. - Audit IIS configuration and site directories for unauthorized modules, unexpected ASHX handlers, recently changed application files, and unfamiliar virtual-directory mappings. The use of
appcmdin the campaign is a reminder that one compromised application pool can expose the topology of multiple hosted sites. - Inspect outbound connections from web servers to unknown download hosts and webhook-style HTTPS endpoints. Talos says the actor used callback services to confirm code execution and exfiltrate reconnaissance results, which can resemble normal SaaS traffic if network controls only inspect destination reputation.
- Rotate exposed ASP.NET
MachineKeyvalues, remove secrets from repositories and deployment packages, keep ViewState MAC enabled, and validate whether applications share keys unnecessarily across separate sites.
Talos has published ClamAV detection signatures and Snort SIDs 66696 and 66697 for this activity. Those detections are useful starting points, but their narrow scope means organizations should pair them with configuration-change monitoring and server-side hunting.
UAT-10147’s use of AI has not made patch management obsolete or produced a magical new intrusion primitive. It has made the aftermath of a preventable web-server breach faster to execute, easier to test, and more repeatable. For Windows server teams, an unexplained Defender exclusion or a suspicious IIS change is now enough reason to assume an attacker may already be working from a documented playbook rather than improvising.
Update: Talos details SPECTRE’s Windows EDR-bypass and credential-theft capabilities (August 20, 2026)
Cisco Talos has now identified SPECTRE as a custom cross-platform backdoor used by UAT-10147, expanding the earlier account of the group’s post-compromise tooling. On Windows, Talos says the implant supports process injection, token theft, SAM/SYSTEM/SECURITY hive collection, Windows Credential Manager enumeration, and Chrome or Edge credential-data theft.
The most significant new concern is SPECTRE’s reported BYOVD capability. Talos says it can load vulnerable MSI or Dell kernel drivers, then alter kernel callback structures to suppress security-product visibility into process, thread and image-load events for the current session. This potentially affects Microsoft Defender as well as third-party EDR products, making ordinary endpoint telemetry less reliable after successful driver loading.
Talos also observed SPECTRE attempting to store its command-and-control configuration in an NTFS alternate data stream attached to the Windows hosts file. Windows responders should therefore investigate suspicious driver-service creation, unexpected vulnerable drivers in temporary directories, abnormal alternate data streams, and evidence of kernel callback tampering alongside the previously identified IIS persistence checks.