UAT-10147 SPECTRE Campaign: Defending Windows and Linux Web Servers Against AI-Scaled Attacks, EDR Bypass, and Kernel Rootkits

A newly disclosed cybercrime group tracked as UAT-10147 is conducting a global campaign against internet-facing Windows and Linux web servers, with victims concentrated in Brazil, Bolivia, China, Canada, and Vietnam and spanning the education, media, technology, and gaming sectors. The activity came to light after researchers stumbled on an exposed, publicly accessible directory containing the group's operational tooling — an OPSEC failure that gave defenders an unusually clear look inside the intrusion pipeline.

Three elements of this campaign should sharpen every defender's attention. First, UAT-10147 is using AI-assisted tooling to scale its operations, compressing the time between initial scanning and compromise and allowing a relatively small crew to operate at a volume previously associated with larger crews. Second, the group deploys an implant dubbed SPECTRE that ships with an EDR bypass capability, meaning your endpoint telemetry may be blind at exactly the moment you need it most. Third, on Linux hosts the actors install a kernel-level rootkit, which can hide processes, files, and network connections from userland tools — including many EDR agents.

If you operate public-facing web servers — particularly Apache, Nginx, or IIS boxes in the targeted sectors — treat this as an active threat, not a theoretical one. This post breaks down the attack chain, what you can and cannot trust in your telemetry, and the specific hunting and hardening steps to take this week.

Technical Analysis

Who and what is affected

• Platforms: Windows and Linux web servers exposed to the internet
• Sectors: Education, media, technology, and gaming — sectors that historically run large fleets of under-patched, high-uptime web infrastructure
• Geography: Highest victim concentration in Brazil, Bolivia, China, Canada, and Vietnam, but the scanning and exploitation model is global

No CVE is associated with this disclosure, and that is itself instructive: campaigns of this type overwhelmingly gain initial access through opportunistic exploitation of known-but-unpatched web application flaws, exposed admin panels, weak credentials, and webshell deployment rather than a single novel zero-day. The AI component lowers the skill floor and raises the tempo — expect more concurrent exploitation attempts against your perimeter than your alert pipeline may be sized for.

Attack chain (defender's view)

1. Reconnaissance and exploitation at scale. AI-assisted tooling automates target enumeration, vulnerability matching, and exploitation attempts against web-facing services. Defenders should expect high-volume, multi-vector probing rather than a single exploit attempt.
2. Initial foothold. Consistent with web server campaigns, the foothold is typically a webshell dropped into a web-accessible directory, giving the actor command execution under the web service account (IIS APPPOOL identities, www-data, apache, nginx).
3. SPECTRE implant deployment. The actors stage the SPECTRE implant, which provides persistent command-and-control and tasking on the compromised host.
4. EDR bypass. Before or during implant deployment, SPECTRE's bypass component degrades or blinds endpoint security tooling. Operationally this can involve tampering with security services, unloading or interfering with sensor drivers/callbacks, or blocking agent telemetry. The defensive implication is stark: absence of EDR alerts is not evidence of absence.
5. Linux rootkit installation. On Linux victims, a kernel-level component (an LKM-style rootkit) is loaded to conceal the implant's processes, files, and network connections from standard userland inspection (ps, ls, netstat, and userland-based EDR agents).
6. Persistence and monetization. As a cybercrime (not espionage) operation, expect follow-on monetization: data theft, resource abuse, or resale of access.

Exploitation status

This is confirmed, active, in-the-wild exploitation across multiple countries and sectors, disclosed through analysis of the group's own exposed tooling directory. There is no CISA KEV entry tied to this campaign because no specific CVE is implicated — the risk is behavioral, not signature-based.

The defensive consequence of EDR bypass + rootkit

This combination inverts normal detection assumptions:

• On Windows, if the sensor is tampered with, process and command-line telemetry goes dark. You must fall back on network telemetry, service/driver installation events from sources the actor can't easily suppress (Sysmon on forward-only channels, Windows event logs shipped off-box), and EDR health monitoring itself — a sensor that stops reporting is a detection.
• On Linux, a kernel rootkit can lie to userland. Cross-check userland views (ps, ss, lsmod) against sources the rootkit must work harder to forge: eBPF-based sensors, network flow data, /sys/module vs. lsmod discrepancies, and memory forensics (Velociraptor/LiME) for critical hosts.

Detection & Response

The detections below target the behaviors that survive an EDR bypass attempt: web server child processes, kernel module loads from anomalous paths, security service tampering, and sensor health gaps. They are tuned to avoid the classic failure mode (alerting on every bash spawn) by anchoring on parent-process context and unusual paths.

Sigma Rules

---
title: Web Server Process Spawning Shell or Script Interpreter
id: 3f8a1c92-4d6e-4b7a-9c1f-2e5d8a0b6f41
status: experimental
description: Detects webshell-style command execution where a web server or database process spawns a shell, consistent with UAT-10147 initial foothold behavior on Windows and Linux web servers.
references:
  - https://thehackernews.com/2026/08/uat-10147-uses-ai-to-scale-server.html
  - https://attack.mitre.org/techniques/T1505/003/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.persistence
  - attack.execution
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\tomcat9.exe'
      - '\sqlservr.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; some legacy admin panels and monitoring plugins spawn shells from the web server context — baseline per application
level: high
---
title: Linux Kernel Module Load From Suspicious Path
id: 9c2e7b14-6a3d-4f81-b5e9-1d4c7a2f8b53
status: experimental
description: Detects insmod/modprobe loading a kernel module from world-writable or non-standard paths, consistent with LKM rootkit installation observed in the UAT-10147 SPECTRE campaign on Linux servers.
references:
  - https://thehackernews.com/2026/08/uat-10147-uses-ai-to-scale-server.html
  - https://attack.mitre.org/techniques/T1547/006/
  - https://attack.mitre.org/techniques/T1014/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.persistence
  - attack.defense_evasion
  - attack.t1547.006
  - attack.t1014
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/insmod'
      - '/modprobe'
  filter_standard:
    CommandLine|contains:
      - '/lib/modules/'
  filter_modprobe_noarg:
    CommandLine|contains: 'modprobe -r'
  condition: selection and not 1 of filter_*
falsepositives:
  - Out-of-tree vendor drivers (GPU, storage) installed by admins — verify the module path and signing status before dismissing
level: high
---
title: Windows Security Service or Sensor Tampering Attempt
id: 5b1d9e47-8c2a-4f63-a7d2-3e9b5c1f6d84
status: experimental
description: Detects attempts to stop, disable, or delete security services and EDR sensors, or install unsigned drivers from anomalous paths, consistent with the EDR bypass component of SPECTRE.
references:
  - https://thehackernews.com/2026/08/uat-10147-uses-ai-to-scale-server.html
  - https://attack.mitre.org/techniques/T1562/001/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc:
    Image|endswith: '\sc.exe'
    CommandLine|contains:
      - 'stop'
      - 'delete'
      - 'config'
  selection_terms:
    CommandLine|contains:
      - 'defender'
      - 'sense'
      - 'MsMpEng'
      - 'crowdstrike'
      - 'csagent'
      - 'sentinel'
      - 'elastic-endpoint'
      - 'sophos'
      - 'carbonblack'
      - 'cb.exe'
  condition: selection_sc and selection_terms
falsepositives:
  - Managed security tooling upgrades performed via software deployment platforms — correlate with change windows
level: critical

KQL — Microsoft Sentinel / Defender

This query hunts the webshell foothold on Windows via Defender for Endpoint, and Linux kernel-module anomalies via Syslog ingestion. Run it across a 14-day window; any hit on a production web server warrants triage the same day.

// Part 1: Webshell execution — web server processes spawning shells (Windows/Linux via MDE)
let WebParents = dynamic(["w3wp.exe", "httpd.exe", "nginx.exe", "php-cgi.exe", "php-fpm", "httpd", "nginx", "apache2", "java.exe", "tomcat"]);
let ShellChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "certutil.exe", "curl.exe", "wget.exe", "/bin/sh", "/bin/bash", "sh", "bash", "curl", "wget"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ (WebParents)
| where FileName in~ (ShellChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, RemoteIP = InitiatingProcessRemoteIP
| order by TimeGenerated desc;

// Part 2: Linux kernel module loads from non-standard paths (rootkit staging) via Syslog
Syslog
| where TimeGenerated > ago(14d)
| where ProcessName in~ ("insmod", "modprobe")
| where SyslogMessage !contains "/lib/modules/"
| project TimeGenerated, HostName, ProcessName, SyslogMessage
| order by TimeGenerated desc;

// Part 3: EDR sensor silence — devices that stopped reporting (possible EDR bypass effect)
DeviceInfo
| summarize LastSeen = max(TimeGenerated) by DeviceName, DeviceId, OSPlatform, OnboardingStatus
| where LastSeen < ago(2h)
| where OnboardingStatus == "Onboarded"
| order by LastSeen asc

Velociraptor VQL

This artifact cross-checks the userland process and connection view against kernel module state — the discrepancy pattern a rootkit produces. Deploy it as a hunt across your Linux server fleet; on Windows clients, the process listing portion still surfaces webshell-spawned children.

-- UAT-10147 hunt: suspicious processes, web server children, and kernel module anomalies
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(insmod|modprobe).*(/tmp|/dev/shm|/var/tmp|/home/)'
   OR (Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ '(?i)(nginx|apache2|httpd|php-fpm|w3wp)')
       AND Name =~ '(?i)(sh|bash|dash|cmd|powershell|curl|wget)')
   OR Exe =~ '(?i)(/tmp/|/dev/shm/|/var/tmp/)'

-- Compare lsmod (userland view) against /sys/module (kernel view): rootkits hide from one but rarely both
LET lsmod_modules = SELECT Name FROM execve(argv=['lsmod'])
LET sys_modules = SELECT basename(path=FullPath) AS Name FROM glob(globs='/sys/module/*')
SELECT Name FROM sys_modules
WHERE Name NOT IN (SELECT Name FROM lsmod_modules)

Remediation / Hardening Script

Run this Bash audit on suspected Linux web servers. It checks for unsigned or hidden kernel modules, webshell artifacts, recently dropped binaries in world-writable paths, and unexpected listeners. It is read-only — it changes nothing — so it is safe to run before imaging.

#!/usr/bin/env bash
# UAT-10147 Linux triage audit — read-only. Run as root.
set -uo pipefail
echo "=== [1] Kernel modules: lsmod vs /sys/module discrepancy (rootkit hiding) ==="
comm -13 <(lsmod | awk 'NR>1 {print $1}' | sort) \
         <(ls /sys/module | sort)
echo "=== [2] Module signature check (unsigned modules are suspicious on signed-kernel hosts) ==="
for m in $(lsmod | awk 'NR>1 {print $1}'); do
  modinfo "$m" 2>/dev/null | grep -q '^signature' || echo "UNSIGNED: $m"
done
echo "=== [3] Executables in world-writable / non-standard paths (last 30 days) ==="
find /tmp /var/tmp /dev/shm /var/www -type f -executable -mtime -30 -ls 2>/dev/null
echo "=== [4] Recently modified files in web roots (webshell sweep) ==="
for root in /var/www /srv/www /usr/share/nginx; do
  [ -d "$root" ] && find "$root" -type f \( -name '*.php' -o -name '*.jsp' -o -name '*.aspx' \) -mtime -14 -ls
done 2>/dev/null
echo "=== [5] Listening sockets vs expected services ==="
ss -tulpn
echo "=== [6] Processes with deleted binaries (classic implant indicator) ==="
ls -l /proc/*/exe 2>/dev/null | grep '(deleted)'
echo "=== [7] Persistence: cron, systemd, ld.preload ==="
cat /etc/ld.so.preload 2>/dev/null || echo "ld.so.preload: absent (good)"
crontab -l 2>/dev/null; ls -la /etc/cron.d/ 2>/dev/null
systemctl list-units --type=service --state=running 2>/dev/null | grep -viE 'systemd|sshd|cron|network|rsyslog|dbus|getty'
echo "=== Audit complete. If any section shows anomalies: isolate the host, capture memory (LiME), and image before remediation. ==="

For Windows servers, the equivalent priority checks are: verify the EDR service state and sensor heartbeat in your console, review Get-Service and driver inventory for unexpected kernel drivers (Get-CimInstance Win32_SystemDriver | Where-Object {$_.PathName -notlike '*System32*'}), and sweep web roots for recently modified .aspx/.ashx files.

Remediation

There is no patch to apply because there is no single CVE — remediation is architectural and operational:

1. Patch the perimeter ruthlessly. UAT-10147's AI-scaled exploitation means any known web application or framework flaw on your perimeter is a matter of when, not if. Enforce aggressive SLAs on internet-facing systems: 72 hours for critical web app/framework fixes, and virtual patching via WAF rules as a bridge.
2. Assume EDR can be blinded; instrument around it. Enable EDR tamper protection everywhere. Ship Sysmon and Windows event logs to an off-box SIEM in near-real time so telemetry survives local sensor tampering. Alert on sensor silence — any onboarded endpoint that stops heartbeating for more than your baseline window is a page-worthy event. Deploy eBPF-based runtime sensors on Linux (they operate in-kernel and are substantially harder for LKM rootkits to deceive than userland agents).
3. Constrain web server blast radius. Run web services under least-privilege accounts, deny outbound egress from web servers except to explicit allowlists (most webshell-to-C2 traffic dies here), and mount web roots read-only where the application allows.
4. Harden Linux kernel surface. Enforce module signing (module.sig_enforce=1), consider kernel lockdown mode, and restrict insmod/modprobe via sudoers and auditd rules logging all module loads.
5. Sweep now, not later. Run the audit script above (or equivalent EDR queries) across every internet-facing Windows and Linux server this week. Any host with kernel module discrepancies, deleted-binary processes, or unexplained web root modifications should be treated as compromised: isolate, capture memory before shutdown, image, and rebuild from known-good media. Rootkit removal by deletion is not a defensible remediation path — rebuild is.
6. Monitor for exposure of your own tooling. Ironic as it is, this campaign was exposed by the actor's open directory. Your IR and red team infrastructure deserves the same scrutiny you give production — an exposed ops directory is how campaigns get burned.

Sector peers in education, media, technology, and gaming should brief leadership on elevated targeting and confirm that web server fleets — including forgotten staging and legacy boxes — are inside patch and telemetry coverage. If you lack 24x7 coverage for the detection logic above, that gap is exactly what UAT-10147's operating tempo is designed to exploit.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub