AI-Augmented Threat Actor UAT-10147 Exploits Unpatched Web Servers with EDR-Bypassing Malware

UAT-10147 is exploiting publicly known vulnerabilities in internet-facing Windows and Linux web servers, compounding the risk by using AI to accelerate reconnaissance, exploitation, and payload generation at scale. The root failure lies in organizations leaving known vulnerabilities unpatched on externally exposed systems, giving attackers a reliable entry point without requiring novel techniques. Once inside, the group deploys rootkits and EDR-bypass tools, demonstrating that delayed patching creates a compounding disadvantage — defenders lose both the prevention opportunity and the detection window. The use of AI by attackers to speed up attack phases means the time between vulnerability disclosure and active exploitation is shrinking, making rapid patch cycles and robust detection pipelines non-negotiable. SEO fraud and data theft as end goals also highlight broader business risk beyond direct system compromise.

Tactical Insight

Immediate actions

Audit and patch all internet-facing web servers against publicly disclosed CVEs, prioritizing those targeted by known exploit frameworks.
Deploy integrity monitoring tools on Linux servers to detect rootkit installation or unauthorized kernel module loading.
Verify EDR coverage is active and up to date on all Windows and Linux production servers.

Long-term improvements

Establish a vulnerability management program with SLA-driven patching timelines (e.g., critical CVEs patched within 24–72 hours of disclosure).
Implement network segmentation to isolate web servers from internal infrastructure, limiting lateral movement post-compromise.
Maintain a continuously updated inventory of all internet-facing assets using automated discovery tools.

Detection measures

Deploy centralized SIEM with rules tuned to detect EDR bypass techniques, abnormal process spawning, and unusual outbound connections from web servers.
Implement file integrity monitoring (FIM) and alerting on changes to critical system binaries and kernel modules.
Monitor for AI-assisted attack indicators such as rapid, high-volume reconnaissance patterns against web application endpoints.

Framework References

CIS Control 7 – Continuous Vulnerability ManagementCIS Control 10 – Malware DefensesCIS Control 12 – Network Infrastructure ManagementCIS Control 13 – Network Monitoring and DefenseNIST SP 800-53 SI-2 (Flaw Remediation)NIST SP 800-53 SI-3 (Malicious Code Protection)NIST SP 800-53 CA-7 (Continuous Monitoring)NIST SP 800-53 SC-7 (Boundary Protection)NIST CSF ID.RA-1 – Asset Vulnerabilities IdentifiedNIST CSF DE.CM-4 – Malicious Code DetectionMITRE ATT&CK T1190 – Exploit Public-Facing ApplicationMITRE ATT&CK T1014 – RootkitMITRE ATT&CK T1562.001 – Impair Defenses: Disable or Modify ToolsGDPR Article 32 – Security of Processing (where EU data is involved)

Source

ThreatNoir coverageUAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit Read originalUAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

Heard on the podcastThreatNoir Afternoon Brief — August 24

PublishedAug 24, 2026