How AI-Powered Attackers Are Outpacing Enterprise Defense

The Attacker’s Toolkit Just Got Smarter

A threat group called UAT-10147 has been quietly scaling server intrusions across five continents, and the most alarming detail isn’t what they’re attacking — it’s how. Cisco Talos researchers uncovered the group in August 2026, finding an infrastructure that blends commodity malware with AI-driven frameworks in a way that suggests attackers are no longer bound by their own technical limits.

The group targets Windows and Linux web servers in education, media, technology and gaming sectors. Roughly 170,000 URLs were catalogued across exposed directories, split into bite-sized chunks for efficient parsing. The top destinations were the United States, India, the United Kingdom, Germany and the Netherlands — but the hit list extends across Brazil, Bolivia, China, Canada and Vietnam as well.

What makes this campaign worth watching is the toolchain. UAT-10147 is running PentestGPT, an open-source autonomous penetration-testing framework, directly on its command-and-control servers to scan targets and execute proof-of-concept exploits with minimal human intervention. The group also deployed DeepAudit, an AI-driven vulnerability scanner, on a management server that remained accessible after compromise.

Talos found no evidence that DeepAudit had been used to find new holes in victim environments. That doesn’t mean it was idle. The tool could be identifying exploitable weaknesses for future operations, or more likely, being used to audit the attackers’ own infrastructure proactively — hunting for exposure before rivals or law enforcement find it first.

AI-Generated Exploits, Human Orchestrated

The group’s Windows attack chain follows a familiar pattern dressed in new clothes. An open vulnerability is exploited for remote code execution, then automated scripts roll out a toolkit that includes the BadIIS malware — a variant tied to a malware-as-a-service model used by multiple Chinese-speaking groups — alongside Quasar RAT, Gh0stCringe and a previously unseen cross-platform backdoor called SPECTRE.

Privilege escalation happens through the Potato family of tools, moving from an IIS AppPool identity to SYSTEM. Credential theft, process injection and file operations follow. One AI-generated Python script handles post-exploitation diagnostics when web shells fail to write. Another automates ViewState deserialization exploits using known ASP.NET MachineKeys pulled from the badsecrets library.

The group isn’t writing novel exploits. They’re automating the assembly, validation and deployment of existing ones at a pace no human operator could sustain alone. That shift — from building custom tooling to orchestrating commodity tooling through AI scaffolding — is what separates this campaign from previous generations of cybercrime.

The EDR Bypass That Matters

SPECTRE is the group’s most technically impressive implant. Written in C, it supports 45 commands on Windows and 29 on Linux. It injects shellcode, hollows processes, records keystrokes and takes screenshots. But the capability that should make security teams sit up is its kernel-level EDR bypass.

The implant uses a technique known as BYOVD — Bring Your Own Vulnerable Driver. It loads two well-known vulnerable driver files: MSI’s RTCore64.sys (CVE-2019-16098) and Dell’s DBUtil_2_3.sys (CVE-2021-21551). Both ships pre-installed on millions of enterprise machines. Once loaded, the implant performs targeted kernel writes to unlink registered EDR callbacks from their doubly-linked lists.

The result is immediate and total. CrowdStrike Falcon, SentinelOne, Microsoft Defender and other major endpoint protection products become blind to new process creation, thread execution and image loading events for the duration of the session. The implant then deletes itself from the host.

Talos researchers noted this represents a significant evolution in commodity intrusion tooling because it doesn’t rely on zero-day vulnerabilities in security software. It exploits drivers that vendors ship, update cycles that enterprises may not have applied, and supply-chain trust relationships that defenders take for granted.

The Linux Rootkit Nobody Will See Coming

The Linux variant of SPECTRE takes the same philosophy further. After anti-sandbox checks — weighted scoring across process names, RAM capacity, CPU cores, disk space and common sandbox identifiers — the implant deploys a kernel module it calls Specter. The rootkit gives the attacker persistent kernel-level control that survives reboots and evades most user-level detection mechanisms.

The source code shows what Talos described as telltale signs of AI-assisted development: descriptive comments explaining each function, uniform decorative separators between sections, and multiple methods achieving the same purpose. Human engineers typically write leaner code. AI models, prompted to be thorough, tend to over-explain and duplicate logic.

The Specter rootkit blocks detection from security products by hooking into kernel structures that user-mode scanners rely on. An enterprise running Linux servers without out-of-band monitoring or hardware-rooted attestation would have no reliable way to confirm the kernel hasn’t been compromised.

Data Exfiltration Hides in Plain Sight

Perhaps the most operationally clever choice UAT-10147 made was how it moves stolen data. Instead of routing exfiltration through obvious C2 channels or traditional reverse shells, the group sends data to an Alibaba Nacos instance — a legitimate cloud-based configuration management service.

This turns the exfiltration path into an asynchronous sink. The attacker polls the Nacos instance to verify successful compromise and retrieve data without maintaining persistent outbound connections that network monitoring tools can flag. The traffic blends with normal administrative operations, making detection through network behavioral analysis significantly harder.

This pattern — hijacking legitimate infrastructure for attack operations — is becoming a baseline technique among sophisticated groups. It forces defenders to rethink what constitutes suspicious outbound traffic.

What Enterprises Should Do Now

The immediate takeaway is that signature-based and behavior-only detection models are insufficient against this tier of automation. Several concrete steps stand out:

Patch the vulnerable drivers. The BYOVD technique depends on specific MSI and Dell driver versions still installed on enterprise endpoints. Applying patch management aggressively reduces the attack surface regardless of EDR configuration.

Assume kernel compromise is possible. If an attacker can unlink EDR callbacks at the kernel level, endpoint monitoring alone cannot guarantee visibility. Network segmentation, egress filtering and out-of-band integrity monitoring become essential complements to endpoint protection.

Audit third-party tooling on C2 servers. The presence of PentestGPT and DeepAudit on compromised infrastructure suggests attackers are deploying autonomous frameworks to reduce operational friction. Regular scanning of internet-facing management servers for unauthorized software installations should be standard practice.

Monitor for Nacos abuse. Any organization running Alibaba Nacos or similar configuration management services should review outbound connection patterns and validate that configuration data isn’t being used as a covert channel.

Expect more of this. The UAT-10147 campaign demonstrates that AI-augmented cybercrime is no longer experimental. The question isn’t whether autonomous attack tooling will become widespread — it already is. The question is whether enterprises will adapt their detection and response strategies fast enough to match the pace.