UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations

What it is

Cisco Talos' technical breakdown of UAT-10147's Windows infection chain, with the specific indicators, file names, and defense-evasion commands the summary omits. Discovered in early 2026 via an OPSEC failure: a compromised host beaconing to a download server at 139.180.197[.]150, which exposed an open directory revealing the actor's tooling and a target list of ~170,000 URLs.

How it works

After gaining RCE (or dropping a web shell for manual setup), the actor runs a main batch script named back.txt or back.bat. It uses certutil to pull down EfsPotato (renamed prcc1.rar), a secondary script (bai.bat), and QuasarRAT disguised as svchosts.exe. EfsPotato provides privilege escalation; the script then adds IIS directories to Windows Defender's exclusion list (blinding AV to where malicious IIS modules land), and deletes staging files to hinder forensics. bai.bat establishes persistence via a scheduled task named "Google Chrome Start" that runs the payload with highest privileges at every user logon. Other implants observed in related campaigns: Gh0stCringe and SPECTRE.

Preconditions / Affected

Internet-exposed Windows and Linux web servers with publicly disclosed, unpatched vulnerabilities. Confirmed victims sit in government, universities, media, technology, and gaming; observed compromised servers in Brazil, Bolivia, China, Canada, and Vietnam. The ~170,000-URL target list was split into 17 files of ~10,000 (the actor uses "w" for 萬 = 10,000), indicating broad opportunistic scanning rather than narrow targeting.

What to do

Hunt for the Defender exclusion additions targeting IIS paths — a strong signal, since legitimate admins rarely exclude these:

powershell Add-MpPreference -ExclusionPath C:\Windows\SysWOW64\inetsrv
powershell Add-MpPreference -ExclusionPath C:\Windows\System32\inetsrv

Detections to build:

• Scheduled task named "Google Chrome Start" running with highest privileges at logon.
• Dropped/staged file names: back.txt, back.bat, bai.bat, prcc1.rar, svchosts.exe.
• Network connections to 139.180.197[.]150.
• certutil used to download the above artifacts.
• QuasarRAT masquerading as svchosts.exe; monitor System32\inetsrv and SysWOW64\inetsrv for unexpected IIS modules (BadIIS).

Caveats

Talos assesses the agentic-AI orchestration claim (iterative exploit refinement, adaptive troubleshooting, automated post-exploitation) with moderate-to-high confidence, not certainty. The BadIIS deployment steps are described as what the actor "would likely perform," and Gh0stCringe/SPECTRE were seen in "similar campaigns" rather than confirmed in every intrusion. SPECTRE details are in a separate companion post.