THREATOPS

THREAT OPS › Threat News › UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

medtalosPublished 2026-08-20

<ul><li>UAT-10147 is a highly capable Chinese-speaking intrusion actor operating a multi-platform post-exploitation ecosystem targeting IIS and Linux servers, combining search engine optimization (SEO) fraud monetization with advanced persistence and defense evasion techniques. </li><li>The newly identified SPECTRE implant represents a significant evolution in commodity intrusion tooling, int

MITRE ATT&CK techniques

Screen CaptureT1113
JavaScriptT1059.007
Process InjectionT1055
Process HollowingT1055.012
CredentialsT1589.001
ImpersonationT1684.001
Windows Credential ManagerT1555.004
Thread Local StorageT1055.005
Generative AIAML.T0016.002
ImpersonationAML.T0073

Indicators of compromise

CVE-2019-16098cve
CVE-2021-21551cve
https://www.trendmicro.com/en_us/research/24/f/noodle-rat-reviewing-the-new-backdoor-used-by-chinese-speaking-g.htmlurl
storage.ghost.iodomain
vn.xyzdomain
index.crates.iodomain

Original source: https://blog.talosintelligence.com/uat-10147-deploys-spectre-a-cross-platform-implant-with-linux-rootkit-and-byovd-capabilities/