kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · CN

UAT-10147

2 stories · 2 in the wild · August 21, 2026 – August 25, 2026

evidence: 2 observed

sectors

  • technology 2 · Aug 25
  • education 1 · Aug 25
  • media 1 · Aug 25
  • retail 1 · Aug 25

geography

  • china 2 · Aug 25
  • bolivia 1 · Aug 25
  • brazil 1 · Aug 25
  • canada 1 · Aug 25
  • vietnam 1 · Aug 25

malware and tools

  • spectre 2 · Aug 25

techniques

  • defense evasion 1 · Aug 25
  • ai assisted recon 1 · Aug 21
  • byovd 1 · Aug 21
  • exploitation 1 · Aug 21
  • rootkit deployment 1 · Aug 21

attack phases seen

  • Defense evasion 2 · Aug 25
  • Execution 1 · Aug 25
  • Persistence 1 · Aug 21
  • Privilege escalation 1 · Aug 21

what we reported, newest first, grouped by story

Aug 21 – August 25, 2026 · 2 reports

  • UAT-10147 deploys SPECTRE with EDR bypass and a Linux rootkit. The Chinese-speaking crew is hitting Windows and Linux web servers across education, media, tech and gaming, concentrated in Brazil, Bolivia, China, Canada and Vietnam, and is using AI to scale operations — details surfaced from an exposed server (The Hacker News) (earlier coverage). · Aug 25 · observed · Threat Activity
  • UAT-10147 has folded agentic AI into post-compromise operations. Cisco Talos documents the Chinese-speaking group deploying SPECTRE, a cross-platform implant with a Linux rootkit and BYOVD capability, against IIS and Linux servers for SEO fraud, persistence and evasion, using AI-assisted automation for exploitation and recon (Talos, Talos). · Aug 21 · observed · AI & Model Security