Cybercrime Group UAT-10147 Targets Servers Worldwide

A new threat from the cybercrime group UAT-10147 has been uncovered by cybersecurity researchers. This group, primarily Chinese-speaking, is targeting Windows and Linux web servers across various sectors, including education, media, technology, and gaming. The attacks are focused on countries such as Brazil, Bolivia, China, Canada, and Vietnam. Researchers discovered that UAT-10147 employs Artificial Intelligence (AI) to enhance the efficiency of their attacks. This technology enables the group to scale attacks and exploit vulnerabilities in the target systems.

The use of AI in cyberattacks represents a new dimension of threat that poses significant challenges for businesses and organizations. A central element of the attacks is the use of SPECTRE, a well-known security vulnerability that allows attackers to access sensitive data. UAT-10147 has also developed techniques to bypass Endpoint Detection and Response (EDR) systems, making it more difficult to detect their activities. These evasion techniques are particularly concerning as they undermine the security measures of many companies. In addition to SPECTRE, the group also utilizes a Linux rootkit to gain control over the compromised systems.

Rootkits are especially dangerous as they embed deeply within the operating system, allowing attackers to remain undetected. The combination of SPECTRE and rootkit technology makes UAT-10147's attacks particularly effective and challenging to combat. The majority of the attacked servers are located in Brazil, where the group has a high success rate. Numerous attacks have also been documented in Bolivia and China. Significant activity has been observed in Canada and Vietnam as well, indicating the group's global reach.

The security situation in the affected sectors is tense. Businesses and organizations are urged to review and strengthen their security measures as necessary. The use of AI by UAT-10147 could inspire the attack strategies of other cybercriminals, increasing the need for proactive security measures. The discovery of this group and its methods has drawn the attention of cybersecurity authorities worldwide. Experts warn that the threat posed by UAT-10147 is not limited to the mentioned countries but could also affect other regions.

International collaboration in cybersecurity is deemed crucial to counter such threats. Researchers recommend that companies conduct regular security audits and analyze their systems for known vulnerabilities. Implementing layered security strategies could help minimize risks. The threat from UAT-10147 underscores the necessity of continuously adapting to the evolving landscape of cyber threats.

The group UAT-10147 exemplifies the increasing complexity and sophistication of modern cyberattacks. The combination of AI, SPECTRE, and rootkit technologies presents a serious challenge to the cybersecurity community. Experts estimate that the group has successfully conducted several hundred attacks in recent months. The vulnerability CVE-2026-1234, associated with SPECTRE, affects millions of devices worldwide and could potentially be exploited by UAT-10147.