Ledger / Feb 2026
UAT-10147 uses PentestGPT, DeepAudit and AI-written scripts against web servers
Confirmed
Talos recovered the tools and AI-generated scripts from an exposed attacker download server.
Talos found the actor running PentestGPT and DeepAudit to scan servers and run matching exploits, plus AI-generated Python scripts automating an ASP.NET ViewState RCE chain. A companion report says AI helped write a Linux rootkit.
“The actor employed a mixture of open-source offensive frameworks, including Metasploit, ysoserial, PentestGPT, DeepAudit, and multiple privilege escalation exploits to automate intrusion operations and establish persistence.”Cisco Talos
Sources
- UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operationsCisco Talos · 20 Aug 2026 · primary source
- Date
- Feb 2026
- Disclosed
- 20 Aug 2026
- Actor
- UAT-10147 (criminal), as attributed by Cisco Talos
- Nexus
- China (Chinese-speaking)
- Targets
- About 170,000 target URLs; Windows and Linux web servers worldwide (Brazil, Bolivia, China, Canada, Vietnam seen)
- What the AI did
- Recon, Exploit dev, Ops automation, Agentic intrusion, Malware dev
- Model
- PentestGPT, DeepAudit
- Model family
- OpenAI, Open-source harness
- Model basis
- stated by researcher
- Autonomy
- semi-autonomous
- Outcome
- Mass exploitation, SPECTRE backdoor deployment, SEO fraud and data theft.