SPECTRE, the backdoor that disables EDRs: inside UAT-10147's arsenal

An open directory reveals 170,000 targeted URLs

Recently, Cisco Talos published a two-part analysis of the Chinese-speaking group UAT-10147, which is active against Windows and Linux web servers on a global scale. The activity came to light from the discovery of an open directory on the host 139.180.197[.]150, which was communicating with an already compromised machine. Inside was a text file containing approximately 170,000 URLs, split by the attacker into 17 smaller files of about 10,000 entries each, to analyze them more efficiently.

The affected sectors include education, media, technology, and gaming. Confirmed victims are located in Brazil, Bolivia, China, Canada, and Vietnam, while the top five destinations by target volume are the United States, India, the United Kingdom, Germany, and the Netherlands. The group conducts SEO fraud and data theft, integrating artificial intelligence-based tools into several stages of the attack: from refining exploits to generating payloads, from validation to operational documentation.

Attack chains on Windows and Linux

On Windows, initial access occurs through known vulnerabilities on vulnerable sites or IIS servers, gaining remote code execution. Automated scripts then install malware designed for SEO fraud or data theft. In some cases, a web shell is uploaded, paving the way for BadIIS and other persistence backdoors.

A batch script uses certutil to download from adminapi.tippusoni[.]in the privilege escalation tool EfsPotato, a second batch script, and Quasar RAT. EfsPotato allows obtaining SYSTEM privileges and configuring Microsoft Defender exclusions. The initial payloads are then deleted to hinder forensic analysis. At that point, subsequent implants are distributed: Gh0stCringe and the new cross-platform backdoor SPECTRE. The second script executes Quasar RAT silently and establishes persistence through a scheduled task named "Google Chrome Start". With elevated privileges, a third script installs BadIIS.

Talos also documents an operational guide for scenarios related to ASP.NET ViewState: using the badsecrets library, the attacker identifies public or leaked ASP.NET MachineKey configurations, verifies their validity, and uses ysoserial.net to build malicious deserialization payloads. After code execution, systematic reconnaissance is performed via PowerShell, and data is exfiltrated to a remote webhook. Interactive persistent access occurs through SPECTRE or by writing an ASHX web shell into the IIS webroot and a PowerShell TCP reverse shell. Privilege escalation from the IIS AppPool identity to SYSTEM uses the Potato family of tools or SPECTRE's built-in routine called spectre_potato().

On Linux, initial access exploits several known vulnerabilities, followed by Local Privilege Escalation exploits to gain root. Among these are CVE-2022-0995, CVE-2021-3156, CVE-2015-5287, CVE-2015-3246, CVE-2010-3904, and CVE-2022-0847. Once root privileges are achieved, multiple backdoors are installed: Noodle RAT (a variant of Gh0st RAT and Rekoobe), SPECTRE, and Meterpreter, to ensure outbound connections to remote C2s.

SPECTRE: the backdoor that blinds security products

SPECTRE is described by Talos as a significant evolution of commodity offensive tooling. It is a cross-platform backdoor written in C, with obfuscation and anti-analysis techniques. C2 communication is via HTTPS. The Windows version supports 45 commands, the Linux version 29. Both implement a weighted anti-sandbox scoring mechanism: the program self-terminates if the score exceeds 50 points, based on blocklists of process names, RAM capacity, number of CPU cores, disk space, detection of sleep acceleration, and common sandbox hostnames and usernames.

The Windows version includes file operations, keylogging, screenshots, download/upload, shell command execution, process enumeration, timestamp modification (timestomp), shellcode injection, process hollowing, and Early Bird APC injection. The most critical capability is the termination of EDR processes via BYOVD (Bring Your Own Vulnerable Driver). SPECTRE loads two known vulnerable drivers: RTCore64.sys from MSI (CVE-2019-16098) and DBUtil_2_3.sys from Dell (CVE-2021-21551). With these, it gains elevated privileges and performs targeted kernel writes to safely "unhook" every EDR callback registered in its doubly linked list. As a result, products such as CrowdStrike Falcon, SentinelOne, Microsoft Defender, and others remain blind for the rest of the session to new process creations, threads, and image loading events.

The Linux variant runs anti-sandbox checks before connecting to the C2 and includes a kernel-level rootkit called Specter, distributed as a kernel module. Talos suspects it was developed by combining AI assistance and human expertise, given the presence of descriptive comments and uniform decorative separators in the code. The rootkit ensures persistent kernel-level control, survives reboots, and evades most user-level checks. Its stated purpose is to prevent detection by security products.

Artificial intelligence as an offensive multiplier

UAT-10147 makes extensive use of open-source offensive frameworks: Metasploit, ysoserial, PentestGPT, and DeepAudit. DeepAudit, an AI-driven framework for vulnerability scanning, was left accessible on the management server. Talos found no evidence that the actor exploited vulnerabilities discovered with DeepAudit in victim environments: the hypotheses are that it was intended to identify vulnerabilities in targets or used defensively to audit their own infrastructure.

PentestGPT, an open-source autonomous penetration testing framework, was installed on the C2 server to scan web servers and execute proof-of-concept. In one case, the group successfully exploited a site and collected information about the victim host. Additionally, four AI-generated Python scripts were identified: a post-exploitation diagnostic utility, a script to download and launch SPECTRE via ViewState deserialization, one to deploy the ASHX web shell using the same mechanism, and one to obfuscate exfiltration traffic with legitimate SaaS traffic over HTTPS. Exfiltration is routed to a cloud configuration management service (Nacos), acting as an asynchronous sink: attackers query their own Nacos instance to verify exploitation success without maintaining persistent reverse shells.

Exploited vulnerabilities and patch status

For initial access, Talos cites CVE-2022-27925 (Zimbra), CVE-2021-23758 (AjaxPro), CVE-2019-18935 (Telerik UI for ASP.NET AJAX), CVE-2021-29441, and CVE-2021-29442 (Alibaba Nacos). The brief does not provide specific NVD details for these vulnerabilities.

The Linux privilege escalation vulnerabilities have more detailed NVD entries. CVE-2021-3156 (Sudo, "Baron Samedit") has CVSS v3 7.8 and affects Sudo versions prior to 1.9.5p2. It has been in the CISA KEV catalog since April 6, 2022, with a remediation deadline for U.S. federal agencies of April 27, 2022. CVE-2022-0847 ("Dirty Pipe") has CVSS 7.8, affects the Linux kernel before 5.10.102, and has been in KEV since April 25, 2022, with a deadline of May 16, 2022. CVE-2010-3904 (Linux kernel RDS) has CVSS 7.8, has been in KEV since May 12, 2023, with a deadline of June 2, 2023, and the required action is to disconnect end-of-life products. CVE-2022-0995 (watch_queue out-of-bounds write) has CVSS 7.8 but does not appear in the KEV catalog. Affected kernel versions range from 5.8 to below 5.10.106, from 5.11 to below 5.15.29, from 5.16 to below 5.16.5, and release candidates 5.17 rc1-rc8. CVE-2015-3246 and CVE-2015-5287 do not have CVSS metrics reported in the brief, although the archive indicates 7.2 and 6.9 in CVSS v2 format, respectively.

The two vulnerable drivers used in BYOVD both have a KEV history: CVE-2021-21551 (Dell DBUtil_2_3.sys) has been in the catalog since March 31, 2022, with a deadline of April 21, 2022, and has CVSS 8.8. CVE-2019-16098 (MSI RTCore64.sys) has CVSS 7.8, but does not appear in KEV in available sources.

In recent months, for the same affected vendors (Red Hat, SUSE, Linux), CVE-2026-34486 (August 4, 2026), CVE-2026-11645 (June 9, 2026), CVE-2026-42271 (June 8, 2026), and CVE-2022-0492 (June 2, 2026) have also been added to the KEV catalog. This confirms the continuous pressure on these ecosystems.

What to do: mitigations and indicators of compromise

For vulnerabilities in the KEV catalog, U.S. federal agencies have past deadlines: those who have not yet applied patches must do so immediately. For CVE-2021-3156, update Sudo to version 1.9.5p2 or later. For CVE-2022-0847, update the Linux kernel beyond 5.10.102 (or corrected versions for your distribution). For CVE-2010-3904, disconnect systems still in use, as the product is end-of-life. For CVE-2022-0995, which is not in KEV, update the kernel to the vendor-recommended corrected versions.

On the BYOVD front, block or revoke the loading of the vulnerable drivers RTCore64.sys and DBUtil_2_3.sys to prevent EDR process termination. At the endpoint level, monitor for the presence of the scheduled task "Google Chrome Start", check for unauthorized Microsoft Defender exclusions, detect abnormal use of certutil to download EfsPotato and Quasar RAT, and look for the presence of the Specter kernel module and SPECTRE files. Pay attention to process hollowing, Early Bird APC injection, and timestomp techniques.

At the network level, monitor connections to 139.180.197[.]150 and adminapi.tippusoni[.]in, HTTPS traffic to unexpected Nacos instances, and data sent to anomalous webhooks containing IIS inventory and privilege assessments.

Since SPECTRE can disable EDR callbacks at the kernel level for the session, integrate monitoring with tools that do not rely exclusively on kernel callbacks and with centralized logs. Also verify the integrity of loaded drivers.