A Chinese cybercriminal group tracked as UAT-10147 is using artificial intelligence agents to automate attacks against internet-exposed Windows and Linux servers. The campaign, identified by Cisco Talos, has targeted organizations in government, education, media, technology, and gaming sectors across multiple countries, including Brazil.
Researchers discovered a list containing approximately 170,000 URLs within the group's infrastructure. Operators split targets into smaller groups to speed up scanning and exploitation of vulnerable systems. Initial access relies primarily on known vulnerabilities in applications such as Zimbra, AjaxPro, Nacos, and Telerik, including remote code execution flaws that allow attackers to take control of unpatched servers.
The use of AI extends far beyond generating basic scripts. Agents observed by Cisco Talos create detailed exploitation guides, refine unsuccessful attacks, verify whether payloads have succeeded, and automate reconnaissance, persistence, and post-exploitation phases. In one documented case, AI agents produced scripts that validate permissions, exploit ViewState deserialization, install implants, and deploy web shells on compromised IIS servers.
Cisco Talos evaluates the activity as an evolution from simple AI-assisted code creation toward semi-autonomous offensive orchestration, marking a significant advancement in how cybercriminals leverage artificial intelligence for large-scale operations.
