Spectra Assure Free Trial
Get your 14-day free trial of Spectra Assure for Software Supply Chain Security
Get Free TrialMore about Spectra Assure Free Trial
A group of Chinese-speaking cybercriminals is using artificial intelligence to orchestrate malicious attacks on government, media, technology, and gaming organizations, a research report has found.
Dubbed UAT-10147, the group is among an emerging class of financially motivated intrusion operators using AI systems to operationalize offensive tradecraft at scale, Cisco Talos threat intelligence group researchers said.
Talos threat intelligence researcher Joey Chen explained in an August 20 blog post that, unlike the traditional use of generative AI for simple scripting assistance, UAT-10147 uses agentic AI for tasks such as:
“This indicates a transition from AI-assisted scripting toward semiautonomous offensive orchestration.”
—Joey Chen
Here’s what you need to know about this new semiautonomous AI attack method — and why developing an agentic security operations center (SOC) strategy is key to modern defense.
[ See webinar: Autonomy, Not Autopilot: Get Real About the Agentic SOC ]
Cisco Talos first detected UAT-10147 early this year as the group targeted vulnerable web servers. The group was observed carrying out multiple criminal activities, including search engine optimization (SEO) fraud and data theft.
Talos found that UAT-10147 was gradually incorporating AI-assisted development into its operations to support the creation and refinement of tools used across its campaigns. A custom-developed backdoor dubbed SPECTRE and a rootkit called Specter both exhibit indications of AI-assisted development, Talos said.
The researchers noted that SPECTRE represents a significant evolution in commodity intrusion tooling, integrating cross-platform command-and-control (C2) operations, process injection, credentiasl theft, anti-analysis protections, and kernel-level endpoint detection and response (EDR) bypass functionality.
UAT-10147 demonstrated operational maturity through the combined use of custom malware, open-source offensive tooling, bring your own virtual driver (BYOVD)-based EDR neutralization, Linux kernel rootkits, and sophisticated in-memory web shell deployment techniques.
After analyzing recovered source code, the researchers also found that portions of the Linux rootkit development may have incorporated AI-assisted code-generation workflows, highlighting the growing role of generative AI in accelerating offensive malware development.
UAT-10147’s exploitation ecosystem demonstrates the power of agentic AI in the hands of malicious actors, said Jacob Krell, senior director for secure AI solutions and cybersecurity at Suzu Labs.
“Agentic AI gives adversaries scale without proportional expertise.”
—Jacob Krell
Krell noted that UAT-10147 relied on publicly disclosed vulnerabilities, some more than a decade old, but had its AI generate a nine-section exploitation guide and four Python scripts to automate delivery, verification, and deployment — work that once required a senior operator to troubleshoot each target individually.
He stressed that one small cybercrime group was able to build a target list of roughly 170,000 URLs because the AI, rather than an experienced operator, handled the adaptive troubleshooting and validation each engagement used to demand.
Post-compromise is where agentic AI does its most damage, said Aviv Nahum, co-founder and CEO of Above Security.
Nahum said that once an attacker has a foothold, the job shifts to investigation: mapping the network, working out which credentials actually function, and deciding where to go next when the first attempt fails.
“That’s an iterative, branching problem, and it is exactly what agents are built for.”
—Aviv Nahum
Where a human operator has to work through those branches one at a time, he said, an agent can build or edit its own tooling on the fly, test a hypothesis, and keep pushing toward the objective without waiting on a person to greenlight the next step.
Luigi Lenguito, CEO and founder of BforeAI, said the UAT-10147 group used AI not just to draft scripts, but also to generate full playbooks covering automated exploit validation, reconnaissance that “phones home,” and step-by-step guides from initial shell to persistence. That kind of automation, he said, is what makes the post-compromise phase “faster, more scalable, and harder to interrupt.”
Agentic AI not only accelerates attacks; it also collapses the expertise curve, said Josh Taylor, lead cybersecurity analyst at Fortra. In the UAT-10147 campaign, agentic tooling quickly generated a ViewState deserialization playbook, a token-impersonation privilege-escalation procedure, and three working deployment scripts — work that once required a team of operators with years of Windows internals experience.
“Tradecraft can now be easily obtained by a good prompt query instead of earned over a career.”
—Josh Taylor
To counter the threats posed by groups such as UAT-10147, organizations are fighting agentic AI with agentic AI. That gave rise to the idea of the agentic SOC.
In an interview at the recent Black Hat security conference, Kanaiya Vasani, CPO and CMO at ExtraHop, told RL Blog that the standard SOC model as fundamentally batch-oriented: alerts arrive from detection and response systems as logs, which a Level 1 analyst triages and turns into cases before escalating to Level 2, and sometimes Level 3, for deeper investigation and proactive threat hunting. That entire cycle, he said, can take hours or even days.
“In the post-Mythos landscape, where you have AI-assisted attackers who can basically find a vulnerability and exploit it in seconds, this model is just not going to work.”
—Kanaiya Vasani
The agentic SOC represents a paradigm shift from batch processing to real-time operations, where telemetry is ingested continuously and behavioral detections fire the moment they trigger, Vasani said.
Agents then bolt on to that detection pipeline — drawing on knowledge graphs and context they’re already logged into — to finish an investigation and drive a response in near real time, whether with a human in the loop or fully autonomously. The result: a pipeline and workflow that executes end to end in minutes, not hours or days.
Security leaders anticipate that AI will handle approximately 60% of SOC workloads within the next three years, said Kamal Shah, CEO of Prophet Security. AI lets teams rapidly filter the noise created by legacy security tools, automate repetitive and tedious work, and spend more time on the parts of the job that still require human judgment — while shortening the time it takes to hand back an answer that clearly states scope, impact, affected assets, and next actions, backed by evidence the business can trust, he said.
John Strand, a principal at Black Hills Information Security, said one of the biggest problems in an SOC is correlating and fusing logs from multiple sources: cloud services, SaaS platforms, endpoints, Active Directory, network traffic, and more.
In a traditional SOC, an analyst needs considerable time to fuse that information into an overall attack path, or even to identify what the attacker is after. AI greatly reduces the time defenders need to pull all of that together, Strand said.
While Donald McFarlane, an advisory board member at Xcape, argues that agentic SOCs aren’t necessary to counter agentic attacks, he acknowledges that defenders need some machine-speed detection and response to match attackers’ operating speed. If an SOC still relies on analysts manually copying IP addresses between consoles and escalating tickets to other humans before any response action occurs, it’s probably time for a change, he said.
There are plenty of things that can safely be automated — enrichment, correlation, hypothesis generation, repetitive investigation, and some containment — though high-consequence actions still need appropriate policy boundaries and, in many cases, human judgment.
“Cyber defense has traditionally placed some reliance on attackers having limited time, limited people and limited attention. Agentic AI starts removing all three constraints.”
—Donald McFarlane
The annual cybersecurity conference focused on frontier AI agents — and what they mean for cyber. Here are three key takeaways.
Researchers built a worm that reasons about hosts it infects, and the open-weight models powering it sit outside AI-provider safety controls.
While prompt injection and data disclosure remain concerns, excessive agency climbed the list — not surprising with recent security incidents.