{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Exploitation of public-facing applications is the primary entry point for UAT-10147. A negative result confirms that while the estate may be vulnerable, no known actor activity related to this campaign has successfully weaponized the exposure." }, "name": "Web Exploit and Telemetry Theft (UAT-10147)", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1041" ], "series": { "slug": "uat-10147-integrates-agentic-ai-into-post-compromise-operations", "index": 1, "title": "UAT-10147 integrates agentic AI into post-compromise operations", "total": 3 }, "related": [ { "hunt": "uat-10147-post-exploit-persistence", "reason": "This hunt covers the entry; the subsequent hunt covers the batch scripts and scheduled tasks used for persistence.", "relation": "follows" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "This is a hunt because it combines vulnerability scoping with behavioural exfiltration patterns across independent queries. A single rule targeting specific domains is trivial to bypass; this hunt looks for the intent behind the traffic across multiple surfaces.", "coverage": [ { "stage": "web-application-exploitation", "steps": [ "vulnerable-asset-scope", "exploit-delivery-requests" ], "status": "covered" }, { "stage": "system-telemetry-exfiltration", "steps": [ "system-telemetry-exfiltration" ], "status": "covered" }, { "stage": "automated-foothold-execution", "reason": "Handled by the persistence-focused hunt in this series.", "status": "out_of_scope" }, { "stage": "privilege-escalation-exploits", "reason": "Handled by the persistence-focused hunt in this series.", "status": "out_of_scope" }, { "stage": "antivirus-exclusion-evasion", "reason": "Handled by the persistence-focused hunt in this series.", "status": "out_of_scope" }, { "stage": "iis-server-discovery", "reason": "Handled by the persistence-focused hunt in this series.", "status": "out_of_scope" }, { "stage": "persistence-mechanisms", "reason": "Handled by the persistence-focused hunt in this series.", "status": "out_of_scope" }, { "stage": "c2-implant-communication", "reason": "Handled by the persistence-focused hunt in this series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Web Application Exploitation", "slug": "web-application-exploitation", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "CVE-2022-27925", "CVE-2021-23758", "CVE-2019-18935", "adminapi.tippusoni.in", "exploitation of Zimbra Collaboration Suite", "exploitation of AjaxPro", "exploitation of Telerik UI for ASP.NET AJAX" ] }, { "name": "Automated Foothold Execution", "slug": "automated-foothold-execution", "tactic": "execution", "techniques": [ "T1059", "T1059.001" ], "observables": [ "back.bat", "back.txt", "user.bat", "bai.bat", "certutil -urlcache -split -f", "Runtime.exec()", "dll.zip", "prcc1.rar" ] }, { "name": "Privilege Escalation Exploits", "slug": "privilege-escalation-exploits", "tactic": "privilege-escalation", "techniques": [ "T1059" ], "observables": [ "EfsPotato", "CVE-2022-0995", "CVE-2021-3156", "CVE-2015-5287", "CVE-2015-3246", "CVE-2010-3904", "CVE-2022-0847", "Dirty Pipe exploitation" ] }, { "name": "Antivirus Exclusion Evasion", "slug": "antivirus-exclusion-evasion", "tactic": "defense-evasion", "techniques": [ "T1059.001" ], "observables": [ "Add-MpPreference -ExclusionPath C:\\Windows\\SysWOW64\\inetsrv", "Add-MpPreference -ExclusionPath C:\\Windows\\System32\\inetsrv", "reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\"", "powershell.exe Add-MpPreference" ] }, { "name": "IIS Server Discovery", "slug": "iis-server-discovery", "tactic": "discovery", "techniques": [ "T1059" ], "observables": [ "appcmd list site /config /xml", "C:\\Windows\\system32\\inetsrv\\appcmd" ] }, { "name": "Persistence Mechanisms", "slug": "persistence-mechanisms", "tactic": "persistence", "techniques": [ "T1053.005", "T1505.003", "T1021.001" ], "observables": [ "Google Chrome Start", "BadIIS", "addition of user to Remote Desktop Users group", "rogue local user account creation", "System32\\inetsrv\\BadIIS.dll" ] }, { "name": "C2 Implant Communication", "slug": "c2-implant-communication", "tactic": "command-and-control", "techniques": [ "T1071", "T1090.003" ], "observables": [ "139.180.197.150", "svchosts.exe", "QuasarRAT", "NoodleRAT", "SPECTRE", "Gh0stCringe", "Meterpreter" ] }, { "name": "System Telemetry Exfiltration", "slug": "system-telemetry-exfiltration", "tactic": "exfiltration", "techniques": [ "T1041" ], "observables": [ "HTTP POST to Nacos configuration server", "exfiltration of id and hostname", "exfiltration of %USERNAME% and %COMPUTERNAME%" ] } ], "summary": "UAT-10147 targets Windows and Linux web servers globally, integrating agentic AI to optimize exploit development and post-compromise orchestration. The campaign leverages high-volume vulnerability exploitation followed by automated privilege escalation, defense evasion through antivirus exclusions, and persistence via rogue IIS modules and scheduled tasks." }, "severity": "high", "rationale": "The hunt prioritizes internet-exposed servers running Zimbra, Telerik UI, or AjaxPro. If vulnerability scanner reports are empty, the analyst should run the HTTP lead queries across all web-facing hosts to account for unmanaged assets.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "The adversary exploits known web vulnerabilities in Zimbra, Telerik, or AjaxPro to achieve initial access and exfiltrates system identifiers to a Nacos configuration server via HTTP POST requests.", "parameters": { "ioc_ips": { "from": { "ref": "https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/", "kind": "article", "observed": "2026-01-15" }, "type": "list[ip]", "default": [ "139.180.197.150" ], "description": "IP addresses of known open-directory download servers." }, "ioc_domains": { "from": { "ref": "https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/", "kind": "article", "observed": "2026-01-15" }, "type": "list[domain]", "default": [ "adminapi.tippusoni.in" ], "description": "Domains used for payload delivery." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Specific hostnames to focus on; leave empty to hunt across all web-facing assets." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "vulnerable_cves": { "from": { "ref": "https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/", "kind": "article", "observed": "2026-01-15" }, "type": "list[string]", "default": [ "CVE-2022-27925", "CVE-2021-23758", "CVE-2019-18935", "CVE-2021-29441", "CVE-2021-29442" ], "description": "CVE IDs associated with UAT-10147 exploitation targets." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/", "name": "Cisco Talos \u2014 UAT-10147 integrates agentic AI into post-compromise operations" } ], "blind_spots": [ { "id": "http-payload-visibility", "risk": "If the adversary exfiltrates telemetry solely in the POST body without markers in the URI, this hunt will miss the activity.", "stage": "web-application-exploitation", "question": "what was the content of the POST body during exfiltration?", "requires": "HTTPS decryption at the boundary or agent-level inspection" }, { "id": "ephemeral-delivery-infrastructure", "risk": "The actor uses legitimate Nacos configuration servers to blend in; if they rotate their exfiltration sink, the hunt relies on generic hostname query markers which may be noisy.", "stage": "web-application-exploitation", "question": "was the server communicating with a new, unreported Nacos instance?", "requires": "Passive DNS or current threat intelligence for Nacos servers" } ] }, "name": "Web Exploit and Telemetry Theft (UAT-10147)", "description": "The UAT-10147 actor exploits internet-exposed web servers using vulnerabilities like CVE-2022-27925 and CVE-2019-18935. Once access is achieved, they deploy scripts that exfiltrate system identifiers (hostname, username) to a Nacos server to verify exploit success. This hunt identifies vulnerable hosts via the software inventory, searches for inbound requests to known C2 download domains, and identifies outbound HTTP exfiltration patterns. An agent weighs the vulnerability status against the observed traffic to settle on a verdict, allowing the analyst to isolate compromised endpoints." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "uat-10147-integrates-agentic-ai-into-post-compromise-operations", "index": 1, "title": "UAT-10147 integrates agentic AI into post-compromise operations", "total": 3 }, "coverage": [ { "stage": "web-application-exploitation", "steps": [ "vulnerable-asset-scope", "exploit-delivery-requests" ], "status": "covered" }, { "stage": "system-telemetry-exfiltration", "steps": [ "system-telemetry-exfiltration" ], "status": "covered" }, { "stage": "automated-foothold-execution", "reason": "Handled by the persistence-focused hunt in this series.", "status": "out_of_scope" }, { "stage": "privilege-escalation-exploits", "reason": "Handled by the persistence-focused hunt in this series.", "status": "out_of_scope" }, { "stage": "antivirus-exclusion-evasion", "reason": "Handled by the persistence-focused hunt in this series.", "status": "out_of_scope" }, { "stage": "iis-server-discovery", "reason": "Handled by the persistence-focused hunt in this series.", "status": "out_of_scope" }, { "stage": "persistence-mechanisms", "reason": "Handled by the persistence-focused hunt in this series.", "status": "out_of_scope" }, { "stage": "c2-implant-communication", "reason": "Handled by the persistence-focused hunt in this series.", "status": "out_of_scope" } ], "rationale": "The adversary exploits known web vulnerabilities in Zimbra, Telerik, or AjaxPro to achieve initial access and exfiltrates system identifiers to a Nacos configuration server via HTTP POST requests.", "blind_spots": [ { "id": "http-payload-visibility", "risk": "If the adversary exfiltrates telemetry solely in the POST body without markers in the URI, this hunt will miss the activity.", "stage": "web-application-exploitation", "question": "what was the content of the POST body during exfiltration?", "requires": "HTTPS decryption at the boundary or agent-level inspection" }, { "id": "ephemeral-delivery-infrastructure", "risk": "The actor uses legitimate Nacos configuration servers to blend in; if they rotate their exfiltration sink, the hunt relies on generic hostname query markers which may be noisy.", "stage": "web-application-exploitation", "question": "was the server communicating with a new, unreported Nacos instance?", "requires": "Passive DNS or current threat intelligence for Nacos servers" } ], "scoping_notes": "The hunt prioritizes internet-exposed servers running Zimbra, Telerik UI, or AjaxPro. If vulnerability scanner reports are empty, the analyst should run the HTTP lead queries across all web-facing hosts to account for unmanaged assets.", "beyond_detection": "This is a hunt because it combines vulnerability scoping with behavioural exfiltration patterns across independent queries. A single rule targeting specific domains is trivial to bypass; this hunt looks for the intent behind the traffic across multiple surfaces." } }, { "id": "vulnerable-asset-scope", "type": "query", "label": "Identify vulnerable web servers", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT device_uid, cve_uid, severity FROM hb_vulnerability_finding WHERE instr(',' || '{{vulnerable_cves}}' || ',', ',' || cve_uid || ',') > 0 AND status != 'suppressed'", "surface": "hb_vulnerability_finding", "description": "Locate assets in the environment currently known to have the vulnerabilities targeted by UAT-10147.", "expected_signal": "A list of devices and their associated CVEs. Silence means no known vulnerable instances are recorded in the scanned estate." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify vulnerable web servers", "reads": [ "device_uid", "cve_uid", "severity", "status" ], "source": "hb_vulnerability_finding", "target": "endpoint", "content": "SELECT DISTINCT device_uid, cve_uid, severity FROM hb_vulnerability_finding WHERE instr(',' || '{{vulnerable_cves}}' || ',', ',' || cve_uid || ',') > 0 AND status != 'suppressed'", "silence": "not_evidence_of_absence", "expected": "A list of devices and their associated CVEs. Silence means no known vulnerable instances are recorded in the scanned estate.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "exploit-delivery-requests", "type": "query", "label": "Download and exploit indicators", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "web", "content": "SELECT device_hostname, url_full, http_method, user_agent, src_endpoint_ip, time FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{ioc_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 OR instr(',' || '{{ioc_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 OR LOWER(url_path) LIKE '%/zimbra/%' OR LOWER(url_path) LIKE '%/telerik/%' OR LOWER(url_path) LIKE '%/ajaxpro/%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_http_activity", "description": "Detect requests to the known UAT-10147 delivery infrastructure and paths commonly associated with targeted web exploits.", "expected_signal": "Inbound requests targeting known exploit paths or traffic to specific malicious domains or IPs. Silence says the delivery server was not accessed." }, "parents": [ { "id": "vulnerable-asset-scope" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Download and exploit indicators", "reads": [ "device_hostname", "url_full", "url_hostname", "url_path", "dst_endpoint_ip", "http_method", "user_agent", "src_endpoint_ip", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, url_full, http_method, user_agent, src_endpoint_ip, time FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{ioc_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 OR instr(',' || '{{ioc_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 OR LOWER(url_path) LIKE '%/zimbra/%' OR LOWER(url_path) LIKE '%/telerik/%' OR LOWER(url_path) LIKE '%/ajaxpro/%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Inbound requests targeting known exploit paths or traffic to specific malicious domains or IPs. Silence says the delivery server was not accessed.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "system-telemetry-exfiltration", "type": "query", "label": "System telemetry exfiltration patterns", "config": { "dsl": "sqlite", "role": "triage", "source": "web", "content": "SELECT device_hostname, url_full, http_method, src_endpoint_ip, COUNT(*) as request_count FROM hb_http_activity WHERE http_method = 'POST' AND (instr(LOWER(url_full), 'hostname') > 0 OR instr(LOWER(url_full), 'username') > 0 OR instr(LOWER(url_full), 'computername') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_full, http_method, src_endpoint_ip", "surface": "hb_http_activity", "description": "Find outbound HTTP POST requests carrying system identifiers, matching the actor's habit of exfiltrating system data to Nacos servers.", "expected_signal": "POST requests containing system attributes in the URI or query parameters. Silence suggests no observed telemetry theft via URI markers." }, "parents": [ { "id": "vulnerable-asset-scope" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "System telemetry exfiltration patterns", "reads": [ "device_hostname", "url_full", "http_method", "src_endpoint_ip", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, url_full, http_method, src_endpoint_ip, COUNT(*) as request_count FROM hb_http_activity WHERE http_method = 'POST' AND (instr(LOWER(url_full), 'hostname') > 0 OR instr(LOWER(url_full), 'username') > 0 OR instr(LOWER(url_full), 'computername') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_full, http_method, src_endpoint_ip", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "POST requests containing system attributes in the URI or query parameters. Silence suggests no observed telemetry theft via URI markers.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "url_full" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "analyze-web-intrusion", "type": "analytic", "label": "Analyze web intrusion evidence", "config": { "cite": "required", "tools": [ "endpoint", "web" ], "context": [ "vulnerable-asset-scope", "exploit-delivery-requests", "system-telemetry-exfiltration" ], "objective": "Determine if any host identified in the scope shows evidence of malicious file downloads and subsequent telemetry exfiltration patterns.", "description": "Correlate vulnerability presence, malicious request activity, and exfiltration patterns to confirm a successful intrusion.", "max_iterations": 5, "expected_signal": "A per-host verdict linking the vulnerability to the malicious download or telemetry POST.", "success_criteria": "A verdict of malicious for any host where exploit-delivery requests align with known vulnerabilities or outbound exfiltration." }, "parents": [ { "id": "exploit-delivery-requests", "kind": "merge" }, { "id": "system-telemetry-exfiltration", "kind": "merge" } ] }, { "id": "judge-intrusion-severity", "type": "checkpoint", "label": "Judge intrusion severity", "config": { "fuzzy": true, "judge": "hunter", "question": "the agent finds any host with a malicious verdict correlating vulnerable services with exploit traffic", "condition": "the agent finds any host with a malicious verdict correlating vulnerable services with exploit traffic", "blind_spot": "http-payload-visibility", "confidence": "high", "description": "Route the result based on the agent's verdict for containment or further manual review.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "analyze-web-intrusion" } ] }, { "id": "isolate-compromised-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Prevent further exfiltration and lateral movement from the confirmed beachhead.", "instructions": "Isolate the host immediately. Do not restart services as this may clear memory-resident payloads. Initiate full IR for web server compromise.", "action_approval": "required" }, "parents": [ { "id": "judge-intrusion-severity", "branch": "on_supports" } ] }, { "id": "forensic-investigation", "type": "task", "label": "Manual forensic investigation", "config": { "assignee": "analyst", "description": "Determine the extent of the breach and identify any lateral movement or persistent shells.", "instructions": "Review the web server logs for the successful POST requests identified. Search for newly created .aspx or .php files that may serve as web shells. Check for abnormal child processes of the web server such as cmd.exe or /bin/bash." }, "parents": [ { "id": "judge-intrusion-severity", "branch": "default" }, { "id": "judge-intrusion-severity", "branch": "on_unavailable" }, { "id": "isolate-compromised-host" } ] }, { "id": "close-out-investigation", "type": "task", "label": "Close out investigation", "config": { "assignee": "analyst", "description": "Document findings and update vulnerability management for exposed systems.", "instructions": "If no activity was found, verify the vulnerable systems from the scoping step are scheduled for patching. Document the coverage achieved by this hunt for the risk registry." }, "parents": [ { "id": "judge-intrusion-severity", "branch": "on_refutes" } ] } ] }