Chinese-speaking crew UAT-10147 hits web servers with AI-built tools and a Linux rootkit

Key points

• Researchers have named a new Chinese-speaking cybercrime group, UAT-10147, that is breaking into Windows and Linux web servers around the world.
• The group hits education, media, technology and gaming organisations, with most victims in Brazil, Bolivia, China, Canada and Vietnam.
• The crew uses a custom toolkit called SPECTRE, along with a Linux rootkit, meaning hidden software that gives attackers deep control of a machine.
• The gang appears to be using AI tools to help write and scale its attacks, according to reporting by The Hacker News.
• The activity was uncovered after investigators found an exposed server that the attackers had left open on the internet.

A new cybercrime crew has been caught breaking into web servers on a global scale, and it looks like they had some help from AI.

Security researchers are tracking the group as UAT-10147. They describe it as Chinese-speaking, financially motivated, and unusually busy for a gang most people had not heard of a month ago.

The victims sit across four industries: education, media, technology and gaming. Most of the hacked servers are in Brazil, Bolivia, China, Canada and Vietnam, though the campaign reaches further.

Who are UAT-10147?

UAT-10147 is the label researchers gave a Chinese-speaking cybercrime group that attacks internet-facing web servers rather than individual laptops. First reported by The Hacker News, the crew hits both Windows and Linux machines, which is unusual: many gangs pick one and stick with it.

Investigators found the group after stumbling on an open server the attackers themselves had left exposed on the public internet. That server held their tools, their notes, and clues about who they had already hit.

The crew is not stealing headlines with big ransom demands. They look like a quieter operation focused on long-term access to servers they can rent out, mine cryptocurrency on, or resell to other criminals.

How do the attacks work?

The hackers break into web servers, install a custom toolkit called SPECTRE, and then hide themselves using a Linux rootkit, which is software that buries itself deep in the operating system so normal security tools cannot see it running.

SPECTRE is built to slip past EDR, short for Endpoint Detection and Response, the modern antivirus that most companies rely on to spot intruders. If the EDR cannot see the attacker, the attacker gets to stay.

On Linux servers, the rootkit does a similar job. It hooks into the low-level parts of the system so that when an administrator runs a command to list running programs or open network connections, the malicious ones are quietly filtered out of the results.

Multi-factor authentication would not have stopped most of this on its own, to be honest. These are server-side break-ins, not stolen passwords from a phishing email. The weak links are usually unpatched web applications and admin panels left open to the internet.

Where does AI come in?

The researchers say UAT-10147 appears to be using AI coding assistants to write and refine parts of its malware, which helps a small team punch above its weight. AI is not doing the hacking, but it is speeding up the plumbing.

That matches a wider pattern this year: smaller crews producing more polished tools, faster, because a chatbot handles the boilerplate code.

What should organisations do?

If you run public-facing web servers, assume you are in scope. Patch your web software, lock down admin interfaces so they are not reachable from the open internet, and check that your EDR is actually reporting from every server, not just the desktops.

On Linux, watch for processes and network connections that show up in low-level logs but not in the usual admin commands. That mismatch is the fingerprint of a rootkit.

And if you find a server that seems fine but is a little too quiet, look harder.