--- analysis: This is a hunt because it combines vulnerability scoping with behavioural exfiltration patterns across independent queries. A single rule targeting specific domains is trivial to bypass; this hunt looks for the intent behind the traffic across multiple surfaces. blind_spots: - id: http-payload-visibility question: what was the content of the POST body during exfiltration? requires: HTTPS decryption at the boundary or agent-level inspection risk: If the adversary exfiltrates telemetry solely in the POST body without markers in the URI, this hunt will miss the activity. stage: web-application-exploitation - id: ephemeral-delivery-infrastructure question: was the server communicating with a new, unreported Nacos instance? requires: Passive DNS or current threat intelligence for Nacos servers risk: The actor uses legitimate Nacos configuration servers to blend in; if they rotate their exfiltration sink, the hunt relies on generic hostname query markers which may be noisy. stage: web-application-exploitation coverage: - stage: web-application-exploitation status: covered steps: - vulnerable-asset-scope - exploit-delivery-requests - stage: system-telemetry-exfiltration status: covered steps: - system-telemetry-exfiltration - reason: Handled by the persistence-focused hunt in this series. stage: automated-foothold-execution status: out_of_scope - reason: Handled by the persistence-focused hunt in this series. stage: privilege-escalation-exploits status: out_of_scope - reason: Handled by the persistence-focused hunt in this series. stage: antivirus-exclusion-evasion status: out_of_scope - reason: Handled by the persistence-focused hunt in this series. stage: iis-server-discovery status: out_of_scope - reason: Handled by the persistence-focused hunt in this series. stage: persistence-mechanisms status: out_of_scope - reason: Handled by the persistence-focused hunt in this series. stage: c2-implant-communication status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: Exploitation of public-facing applications is the primary entry point for UAT-10147. A negative result confirms that while the estate may be vulnerable, no known actor activity related to this campaign has successfully weaponized the exposure. methodology: model-assisted trigger: intel-report hypothesis: The adversary exploits known web vulnerabilities in Zimbra, Telerik, or AjaxPro to achieve initial access and exfiltrates system identifiers to a Nacos configuration server via HTTP POST requests. labels: - hunt - attack.t1190 - attack.t1041 name: Web Exploit and Telemetry Theft (UAT-10147) parameters: ioc_domains: default: - adminapi.tippusoni.in description: Domains used for payload delivery. from: kind: article observed: '2026-01-15' ref: https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/ type: list[domain] ioc_ips: default: - 139.180.197.150 description: IP addresses of known open-directory download servers. from: kind: article observed: '2026-01-15' ref: https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/ type: list[ip] lookback_days: default: '14' description: Days of history to examine. type: number scope_hosts: default: [] description: Specific hostnames to focus on; leave empty to hunt across all web-facing assets. type: list[host] vulnerable_cves: default: - CVE-2022-27925 - CVE-2021-23758 - CVE-2019-18935 - CVE-2021-29441 - CVE-2021-29442 description: CVE IDs associated with UAT-10147 exploitation targets. from: kind: article observed: '2026-01-15' ref: https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/ type: list[string] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/ gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: The hunt prioritizes internet-exposed servers running Zimbra, Telerik UI, or AjaxPro. If vulnerability scanner reports are empty, the analyst should run the HTTP lead queries across all web-facing hosts to account for unmanaged assets. references: - name: "Cisco Talos \u2014 UAT-10147 integrates agentic AI into post-compromise operations" url: https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/ related: - hunt: uat-10147-post-exploit-persistence reason: This hunt covers the entry; the subsequent hunt covers the batch scripts and scheduled tasks used for persistence. relation: follows scenario: stages: - name: Web Application Exploitation observables: - CVE-2022-27925 - CVE-2021-23758 - CVE-2019-18935 - adminapi.tippusoni.in - exploitation of Zimbra Collaboration Suite - exploitation of AjaxPro - exploitation of Telerik UI for ASP.NET AJAX slug: web-application-exploitation tactic: initial-access techniques: - T1190 - name: Automated Foothold Execution observables: - back.bat - back.txt - user.bat - bai.bat - certutil -urlcache -split -f - Runtime.exec() - dll.zip - prcc1.rar slug: automated-foothold-execution tactic: execution techniques: - T1059 - T1059.001 - name: Privilege Escalation Exploits observables: - EfsPotato - CVE-2022-0995 - CVE-2021-3156 - CVE-2015-5287 - CVE-2015-3246 - CVE-2010-3904 - CVE-2022-0847 - Dirty Pipe exploitation slug: privilege-escalation-exploits tactic: privilege-escalation techniques: - T1059 - name: Antivirus Exclusion Evasion observables: - Add-MpPreference -ExclusionPath C:\Windows\SysWOW64\inetsrv - Add-MpPreference -ExclusionPath C:\Windows\System32\inetsrv - reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" - powershell.exe Add-MpPreference slug: antivirus-exclusion-evasion tactic: defense-evasion techniques: - T1059.001 - name: IIS Server Discovery observables: - appcmd list site /config /xml - C:\Windows\system32\inetsrv\appcmd slug: iis-server-discovery tactic: discovery techniques: - T1059 - name: Persistence Mechanisms observables: - Google Chrome Start - BadIIS - addition of user to Remote Desktop Users group - rogue local user account creation - System32\inetsrv\BadIIS.dll slug: persistence-mechanisms tactic: persistence techniques: - T1053.005 - T1505.003 - T1021.001 - name: C2 Implant Communication observables: - 139.180.197.150 - svchosts.exe - QuasarRAT - NoodleRAT - SPECTRE - Gh0stCringe - Meterpreter slug: c2-implant-communication tactic: command-and-control techniques: - T1071 - T1090.003 - name: System Telemetry Exfiltration observables: - HTTP POST to Nacos configuration server - exfiltration of id and hostname - exfiltration of %USERNAME% and %COMPUTERNAME% slug: system-telemetry-exfiltration tactic: exfiltration techniques: - T1041 summary: UAT-10147 targets Windows and Linux web servers globally, integrating agentic AI to optimize exploit development and post-compromise orchestration. The campaign leverages high-volume vulnerability exploitation followed by automated privilege escalation, defense evasion through antivirus exclusions, and persistence via rogue IIS modules and scheduled tasks. series: index: 1 slug: uat-10147-integrates-agentic-ai-into-post-compromise-operations title: UAT-10147 integrates agentic AI into post-compromise operations total: 3 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # Web Exploit and Telemetry Theft (UAT-10147) The UAT-10147 actor exploits internet-exposed web servers using vulnerabilities like CVE-2022-27925 and CVE-2019-18935. Once access is achieved, they deploy scripts that exfiltrate system identifiers (hostname, username) to a Nacos server to verify exploit success. This hunt identifies vulnerable hosts via the software inventory, searches for inbound requests to known C2 download domains, and identifies outbound HTTP exfiltration patterns. An agent weighs the vulnerability status against the observed traffic to settle on a verdict, allowing the analyst to isolate compromised endpoints. ## vulnerable-asset-scope Locate assets in the environment currently known to have the vulnerabilities targeted by UAT-10147. ```sqlite target=endpoint role=scoping params=(vulnerable_cves=vulnerable_cves) ~~~yaml expected: A list of devices and their associated CVEs. Silence means no known vulnerable instances are recorded in the scanned estate. reads: - device_uid - cve_uid - severity - status silence: not_evidence_of_absence source: hb_vulnerability_finding verified: dry-run verified_at: '2026-09-20' ~~~ SELECT DISTINCT device_uid, cve_uid, severity FROM hb_vulnerability_finding WHERE instr(',' || '{{vulnerable_cves}}' || ',', ',' || cve_uid || ',') > 0 AND status != 'suppressed' ``` ## parallel-activity-check parallel: - → exploit-delivery-requests - → system-telemetry-exfiltration join: → analyze-web-intrusion ## exploit-delivery-requests Detect requests to the known UAT-10147 delivery infrastructure and paths commonly associated with targeted web exploits. ```sqlite target=web role=detection-candidate params=(scope_hosts=scope_hosts, ioc_domains=ioc_domains, ioc_ips=ioc_ips, lookback_days=lookback_days) ~~~yaml expected: Inbound requests targeting known exploit paths or traffic to specific malicious domains or IPs. Silence says the delivery server was not accessed. reads: - device_hostname - url_full - url_hostname - url_path - dst_endpoint_ip - http_method - user_agent - src_endpoint_ip - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, url_full, http_method, user_agent, src_endpoint_ip, time FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{ioc_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 OR instr(',' || '{{ioc_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 OR LOWER(url_path) LIKE '%/zimbra/%' OR LOWER(url_path) LIKE '%/telerik/%' OR LOWER(url_path) LIKE '%/ajaxpro/%') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## system-telemetry-exfiltration Find outbound HTTP POST requests carrying system identifiers, matching the actor's habit of exfiltrating system data to Nacos servers. ```sqlite target=web role=triage params=(scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: POST requests containing system attributes in the URI or query parameters. Silence suggests no observed telemetry theft via URI markers. prevalence: by: device_hostname key: - url_full rare_below: 3 reads: - device_hostname - url_full - http_method - src_endpoint_ip - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, url_full, http_method, src_endpoint_ip, COUNT(*) as request_count FROM hb_http_activity WHERE http_method = 'POST' AND (instr(LOWER(url_full), 'hostname') > 0 OR instr(LOWER(url_full), 'username') > 0 OR instr(LOWER(url_full), 'computername') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_full, http_method, src_endpoint_ip ``` ## analyze-web-intrusion ```agent target=hunter cite: required context: - vulnerable-asset-scope - exploit-delivery-requests - system-telemetry-exfiltration max_iterations: 5 objective: Determine if any host identified in the scope shows evidence of malicious file downloads and subsequent telemetry exfiltration patterns. success_criteria: A verdict of malicious for any host where exploit-delivery requests align with known vulnerabilities or outbound exfiltration. tools: - endpoint - web ``` ## judge-intrusion-severity if~: "the agent finds any host with a malicious verdict correlating vulnerable services with exploit traffic" (confidence: high, judge=hunter) then: → isolate-compromised-host indeterminate: → forensic-investigation unavailable: → forensic-investigation (blind_spot: http-payload-visibility) else: → close-out-investigation ## isolate-compromised-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host immediately. Do not restart services as this may clear memory-resident payloads. Initiate full IR for web server compromise. ``` → forensic-investigation ## forensic-investigation ```manual target=analyst Review the web server logs for the successful POST requests identified. Search for newly created .aspx or .php files that may serve as web shells. Check for abnormal child processes of the web server such as cmd.exe or /bin/bash. ``` → end ## close-out-investigation ```manual target=analyst If no activity was found, verify the vulnerable systems from the scoping step are scheduled for patching. Document the coverage achieved by this hunt for the risk registry. ``` → end