Skip to content
brandefense.io
Request A Demo
CybercrimeFinancialAdvanced sophistication

UAT-10147

UAT-10147 is a cybercrime syndicate with a financial motive, tracked by Brandefense. It targets 4 sectors, including Government and Technology, in 18 countries, including the United States and the United Kingdom. It uses 19 MITRE ATT&CK techniques and exploits 10 known CVEs.

Request IOC feedRequest ATT&CK export
Techniques
19
Exploited CVEs
10
First seen
Jan 1, 2026
Last seen
Apr 19, 2026
Record updated

Who They Target.

Sectors · 4
Countries · 18
Labelsai-assisted-operationschinese-speakingcybercrimeseo-fraudserver-compromise

How They Operate · MITRE ATT&CK.

19 techniques across 9 of 15 tactics

Reconnaissance3

T1033
System Owner/User Discovery
T1082
System Information Discovery
T1595.002
Active Scanning: Vulnerability Scanning

Resource Development·

Initial Access2

T1190
Exploit Public-Facing Application
T1505.003
Server Software Component: Web Shell

Execution5

T1053.005
Scheduled Task/Job: Scheduled Task
T1059.001
Command and Scripting Interpreter: PowerShell
T1059.003
Command and Scripting Interpreter: Windows Command Shell
T1059.004
Command and Scripting Interpreter: Unix Shell
T1105
Ingress Tool Transfer

Persistence2

T1112
Modify Registry
T1136.001
Create Account: Local Account

Privilege Escalation2

T1068
Exploitation for Privilege Escalation
T1134.001
Access Token Manipulation: Token Impersonation/Theft

Defense Evasion1

T1070.004
Indicator Removal: File Deletion

Credential Access·

Discovery2

T1016
System Network Configuration Discovery
T1083
File and Directory Discovery

Lateral Movement·

Collection·

Command and Control·

Exfiltration1

T1567.004
Exfiltration Over Web Service: Exfiltration Over Webhook

Impact·

Defense Impairment1

T1685
Disable or Modify Tools

Vulnerabilities They Exploit.

Browse Vulnerability Intelligence →
CVE-2019-18935Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context…ExploitedcriticalCVE-2021-23758Unsafe deserialization in ajaxpro.2 can enable arbitrary .NET object instantiation and code execution.ExploitedcriticalCVE-2010-3904Insufficient address validation in the Linux RDS implementation can permit local privilege escalation.ExploitedhighCVE-2015-5287Predictable-file symlink handling in the ABRT crash helper can permit local privilege escalation under the documented permission conditions.ExploitedhighCVE-2021-21551Insufficient access controls in a Dell utility driver can permit local authenticated privilege escalation or other impact.ExploitedhighCVE-2021-3156A sudo argument handling heap overflow can permit local privilege escalation.ExploitedhighCVE-2022-0847Linux kernel contains an improper initialization vulnerability where an unprivileged local user could escalate their privileges on the system.ExploitedhighCVE-2022-0995A Linux watch_queue out-of-bounds write can permit local privilege escalation or denial of service.ExploitedhighCVE-2022-27925Directory traversal and arbitrary file upload in mailbox import functionality; the base record requires an authenticated administrator.ExploitedhighCVE-2015-3246Improper account-file handling in libuser can corrupt passwd state.Exploitedmedium

Other linked vulnerabilities

Linked to UAT-10147 in Brandefense intelligence, without evidence of exploitation in the wild.

CVE-2021-29441An authentication filter bypass in older Nacos releases that can expose administrative functions.criticalCVE-2019-16098An MSI utility driver exposes memory access primitives to authenticated users and can support kernel-level abuse.highCVE-2021-29442An unprotected Nacos management endpoint in embedded Derby configurations; it is not described as a standalone universal code execution primitive.high

Linked through malware and tools

Targeted by malware or tools UAT-10147 uses; not reported as exploited by the actor itself.

CVE-2023-36802Microsoft Streaming Service Proxy contains an unspecified vulnerability that allows for privilege escalation.ExploitedhighCVE-2019-3980The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to upload an executable to be executed on the DWRCS.exe host.critical

Arsenal · Malware And Tools.

  • BadIISmalware
  • Gh0stCringemalware
  • Noodle RATmalware
  • QuasarRATmalware
  • SeoEngineHandlermalware
  • Specter rootkit (UAT-10147)malware
  • SPECTRE (UAT-10147)malware
  • UAT-10147 ASHX web shellmalware
  • EfsPotatotool
  • GodPotatotool
  • JuicyPotatotool
  • Metasploittool
  • Meterpretertool
  • PentestGPTtool
  • RustPotatotool
  • ysoserial (Java)tool
  • ysoserial.nettool

About UAT-10147.

UAT-10147 is a Chinese-speaking, financially motivated intrusion group that compromises internet-facing web servers for search traffic manipulation and data theft. Its reported operations combine vulnerability exploitation, automated deployment, custom implants and publicly available offensive utilities. The group uses AI-assisted workflows for reconnaissance, exploitation support and post-compromise tasks. Its tooling includes cross-platform backdoors, kernel-level concealment and security-tool evasion. Public reporting places the activity in early 2026; the first-seen timestamp is a year-level normalization, not an observed event on that day. The last-seen field records an operational log dated 19 April 2026; it does not establish when activity ended. Physical origin, membership and sponsorship remain unverified.

Last updated Oct 20, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.