Web Exploit and Telemetry Theft (UAT-10147)

Source

---
analysis: This is a hunt because it combines vulnerability scoping with behavioural
  exfiltration patterns across independent queries. A single rule targeting specific
  domains is trivial to bypass; this hunt looks for the intent behind the traffic
  across multiple surfaces.
blind_spots:
- id: http-payload-visibility
  question: what was the content of the POST body during exfiltration?
  requires: HTTPS decryption at the boundary or agent-level inspection
  risk: If the adversary exfiltrates telemetry solely in the POST body without markers
    in the URI, this hunt will miss the activity.
  stage: web-application-exploitation
- id: ephemeral-delivery-infrastructure
  question: was the server communicating with a new, unreported Nacos instance?
  requires: Passive DNS or current threat intelligence for Nacos servers
  risk: The actor uses legitimate Nacos configuration servers to blend in; if they
    rotate their exfiltration sink, the hunt relies on generic hostname query markers
    which may be noisy.
  stage: web-application-exploitation
coverage:
- stage: web-application-exploitation
  status: covered
  steps:
  - vulnerable-asset-scope
  - exploit-delivery-requests
- stage: system-telemetry-exfiltration
  status: covered
  steps:
  - system-telemetry-exfiltration
- reason: Handled by the persistence-focused hunt in this series.
  stage: automated-foothold-execution
  status: out_of_scope
- reason: Handled by the persistence-focused hunt in this series.
  stage: privilege-escalation-exploits
  status: out_of_scope
- reason: Handled by the persistence-focused hunt in this series.
  stage: antivirus-exclusion-evasion
  status: out_of_scope
- reason: Handled by the persistence-focused hunt in this series.
  stage: iis-server-discovery
  status: out_of_scope
- reason: Handled by the persistence-focused hunt in this series.
  stage: persistence-mechanisms
  status: out_of_scope
- reason: Handled by the persistence-focused hunt in this series.
  stage: c2-implant-communication
  status: out_of_scope
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: keep-as-periodic-hunt
  justification: Exploitation of public-facing applications is the primary entry point
    for UAT-10147. A negative result confirms that while the estate may be vulnerable,
    no known actor activity related to this campaign has successfully weaponized the
    exposure.
  methodology: model-assisted
  trigger: intel-report
hypothesis: The adversary exploits known web vulnerabilities in Zimbra, Telerik, or
  AjaxPro to achieve initial access and exfiltrates system identifiers to a Nacos
  configuration server via HTTP POST requests.
labels:
- hunt
- attack.t1190
- attack.t1041
name: Web Exploit and Telemetry Theft (UAT-10147)
parameters:
  ioc_domains:
    default:
    - adminapi.tippusoni.in
    description: Domains used for payload delivery.
    from:
      kind: article
      observed: '2026-01-15'
      ref: https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/
    type: list[domain]
  ioc_ips:
    default:
    - 139.180.197.150
    description: IP addresses of known open-directory download servers.
    from:
      kind: article
      observed: '2026-01-15'
      ref: https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/
    type: list[ip]
  lookback_days:
    default: '14'
    description: Days of history to examine.
    type: number
  scope_hosts:
    default: []
    description: Specific hostnames to focus on; leave empty to hunt across all web-facing
      assets.
    type: list[host]
  vulnerable_cves:
    default:
    - CVE-2022-27925
    - CVE-2021-23758
    - CVE-2019-18935
    - CVE-2021-29441
    - CVE-2021-29442
    description: CVE IDs associated with UAT-10147 exploitation targets.
    from:
      kind: article
      observed: '2026-01-15'
      ref: https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/
    type: list[string]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/
    gates:
    - dry-run
    - lint
    - critic
    model: hb_google/gemini-3-flash-preview
rationale: The hunt prioritizes internet-exposed servers running Zimbra, Telerik UI,
  or AjaxPro. If vulnerability scanner reports are empty, the analyst should run the
  HTTP lead queries across all web-facing hosts to account for unmanaged assets.
references:
- name: "Cisco Talos \u2014 UAT-10147 integrates agentic AI into post-compromise operations"
  url: https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/
related:
- hunt: uat-10147-post-exploit-persistence
  reason: This hunt covers the entry; the subsequent hunt covers the batch scripts
    and scheduled tasks used for persistence.
  relation: follows
scenario:
  stages:
  - name: Web Application Exploitation
    observables:
    - CVE-2022-27925
    - CVE-2021-23758
    - CVE-2019-18935
    - adminapi.tippusoni.in
    - exploitation of Zimbra Collaboration Suite
    - exploitation of AjaxPro
    - exploitation of Telerik UI for ASP.NET AJAX
    slug: web-application-exploitation
    tactic: initial-access
    techniques:
    - T1190
  - name: Automated Foothold Execution
    observables:
    - back.bat
    - back.txt
    - user.bat
    - bai.bat
    - certutil -urlcache -split -f
    - Runtime.exec()
    - dll.zip
    - prcc1.rar
    slug: automated-foothold-execution
    tactic: execution
    techniques:
    - T1059
    - T1059.001
  - name: Privilege Escalation Exploits
    observables:
    - EfsPotato
    - CVE-2022-0995
    - CVE-2021-3156
    - CVE-2015-5287
    - CVE-2015-3246
    - CVE-2010-3904
    - CVE-2022-0847
    - Dirty Pipe exploitation
    slug: privilege-escalation-exploits
    tactic: privilege-escalation
    techniques:
    - T1059
  - name: Antivirus Exclusion Evasion
    observables:
    - Add-MpPreference -ExclusionPath C:\Windows\SysWOW64\inetsrv
    - Add-MpPreference -ExclusionPath C:\Windows\System32\inetsrv
    - reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
    - powershell.exe Add-MpPreference
    slug: antivirus-exclusion-evasion
    tactic: defense-evasion
    techniques:
    - T1059.001
  - name: IIS Server Discovery
    observables:
    - appcmd list site /config /xml
    - C:\Windows\system32\inetsrv\appcmd
    slug: iis-server-discovery
    tactic: discovery
    techniques:
    - T1059
  - name: Persistence Mechanisms
    observables:
    - Google Chrome Start
    - BadIIS
    - addition of user to Remote Desktop Users group
    - rogue local user account creation
    - System32\inetsrv\BadIIS.dll
    slug: persistence-mechanisms
    tactic: persistence
    techniques:
    - T1053.005
    - T1505.003
    - T1021.001
  - name: C2 Implant Communication
    observables:
    - 139.180.197.150
    - svchosts.exe
    - QuasarRAT
    - NoodleRAT
    - SPECTRE
    - Gh0stCringe
    - Meterpreter
    slug: c2-implant-communication
    tactic: command-and-control
    techniques:
    - T1071
    - T1090.003
  - name: System Telemetry Exfiltration
    observables:
    - HTTP POST to Nacos configuration server
    - exfiltration of id and hostname
    - exfiltration of %USERNAME% and %COMPUTERNAME%
    slug: system-telemetry-exfiltration
    tactic: exfiltration
    techniques:
    - T1041
  summary: UAT-10147 targets Windows and Linux web servers globally, integrating agentic
    AI to optimize exploit development and post-compromise orchestration. The campaign
    leverages high-volume vulnerability exploitation followed by automated privilege
    escalation, defense evasion through antivirus exclusions, and persistence via
    rogue IIS modules and scheduled tasks.
series:
  index: 1
  slug: uat-10147-integrates-agentic-ai-into-post-compromise-operations
  title: UAT-10147 integrates agentic AI into post-compromise operations
  total: 3
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  web:
    category: siem
    name: Web server / proxy logs
    telemetry:
    - network
tlp: clear
type: investigation
---


# Web Exploit and Telemetry Theft (UAT-10147)

The UAT-10147 actor exploits internet-exposed web servers using vulnerabilities like CVE-2022-27925 and CVE-2019-18935. Once access is achieved, they deploy scripts that exfiltrate system identifiers (hostname, username) to a Nacos server to verify exploit success. This hunt identifies vulnerable hosts via the software inventory, searches for inbound requests to known C2 download domains, and identifies outbound HTTP exfiltration patterns. An agent weighs the vulnerability status against the observed traffic to settle on a verdict, allowing the analyst to isolate compromised endpoints.

## vulnerable-asset-scope
<!-- Identify vulnerable web servers -->
Locate assets in the environment currently known to have the vulnerabilities targeted by UAT-10147.

```sqlite target=endpoint role=scoping params=(vulnerable_cves=vulnerable_cves)
~~~yaml
expected: A list of devices and their associated CVEs. Silence means no known vulnerable
  instances are recorded in the scanned estate.
reads:
- device_uid
- cve_uid
- severity
- status
silence: not_evidence_of_absence
source: hb_vulnerability_finding
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT DISTINCT device_uid, cve_uid, severity FROM hb_vulnerability_finding WHERE instr(',' || '{{vulnerable_cves}}' || ',', ',' || cve_uid || ',') > 0 AND status != 'suppressed'
```

## parallel-activity-check
<!-- Search for exploitation and exfiltration -->
parallel:
- → exploit-delivery-requests
- → system-telemetry-exfiltration
join: → analyze-web-intrusion

## exploit-delivery-requests
<!-- Download and exploit indicators -->
Detect requests to the known UAT-10147 delivery infrastructure and paths commonly associated with targeted web exploits.

```sqlite target=web role=detection-candidate params=(scope_hosts=scope_hosts, ioc_domains=ioc_domains, ioc_ips=ioc_ips, lookback_days=lookback_days)
~~~yaml
expected: Inbound requests targeting known exploit paths or traffic to specific malicious
  domains or IPs. Silence says the delivery server was not accessed.
reads:
- device_hostname
- url_full
- url_hostname
- url_path
- dst_endpoint_ip
- http_method
- user_agent
- src_endpoint_ip
- time
silence: not_evidence_of_absence
source: hb_http_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, url_full, http_method, user_agent, src_endpoint_ip, time FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{ioc_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 OR instr(',' || '{{ioc_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 OR LOWER(url_path) LIKE '%/zimbra/%' OR LOWER(url_path) LIKE '%/telerik/%' OR LOWER(url_path) LIKE '%/ajaxpro/%') AND time >= datetime('now', '-{{lookback_days}} days')
```

## system-telemetry-exfiltration
<!-- System telemetry exfiltration patterns -->
Find outbound HTTP POST requests carrying system identifiers, matching the actor's habit of exfiltrating system data to Nacos servers.

```sqlite target=web role=triage params=(scope_hosts=scope_hosts, lookback_days=lookback_days)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: POST requests containing system attributes in the URI or query parameters.
  Silence suggests no observed telemetry theft via URI markers.
prevalence:
  by: device_hostname
  key:
  - url_full
  rare_below: 3
reads:
- device_hostname
- url_full
- http_method
- src_endpoint_ip
- time
silence: not_evidence_of_absence
source: hb_http_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, url_full, http_method, src_endpoint_ip, COUNT(*) as request_count FROM hb_http_activity WHERE http_method = 'POST' AND (instr(LOWER(url_full), 'hostname') > 0 OR instr(LOWER(url_full), 'username') > 0 OR instr(LOWER(url_full), 'computername') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_full, http_method, src_endpoint_ip
```

## analyze-web-intrusion
<!-- Analyze web intrusion evidence -->
```agent target=hunter
cite: required
context:
- vulnerable-asset-scope
- exploit-delivery-requests
- system-telemetry-exfiltration
max_iterations: 5
objective: Determine if any host identified in the scope shows evidence of malicious
  file downloads and subsequent telemetry exfiltration patterns.
success_criteria: A verdict of malicious for any host where exploit-delivery requests
  align with known vulnerabilities or outbound exfiltration.
tools:
- endpoint
- web
```

## judge-intrusion-severity
<!-- Judge intrusion severity -->
if~: "the agent finds any host with a malicious verdict correlating vulnerable services with exploit traffic" (confidence: high, judge=hunter)
then: → isolate-compromised-host
indeterminate: → forensic-investigation
unavailable: → forensic-investigation (blind_spot: http-payload-visibility)
else: → close-out-investigation

## isolate-compromised-host
<!-- Isolate compromised host -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the host immediately. Do not restart services as this may clear memory-resident payloads. Initiate full IR for web server compromise.
```
→ forensic-investigation

## forensic-investigation
<!-- Manual forensic investigation -->
```manual target=analyst
Review the web server logs for the successful POST requests identified. Search for newly created .aspx or .php files that may serve as web shells. Check for abnormal child processes of the web server such as cmd.exe or /bin/bash.
```
→ end

## close-out-investigation
<!-- Close out investigation -->
```manual target=analyst
If no activity was found, verify the vulnerable systems from the scoping step are scheduled for patching. Document the coverage achieved by this hunt for the risk registry.
```
→ end