Chinese attackers automate attacks on web servers

Published August 21, 2026

A Chinese-speaking hacking group called UAT-10147 is using AI tools to break into internet-facing web servers faster and at bigger scale. Cisco Talos found the group hit government, education, media, technology, and gaming targets in several countries, breaking in through known software flaws and then using AI-generated scripts to escalate access and plant backdoors.

Report priority
Medium
Targets
Zimbra+5 more

How it works

The attackers exploit known, already-documented remote-code-execution flaws in server software like Zimbra, AjaxPro, Nacos, and Telerik to get a first foothold, then use AI-generated scripts to figure out privilege escalation, test whether each step worked, and set up persistent backdoors with far less manual work than before.

What to do

Check whether any public-facing server runs Zimbra, AjaxPro, Nacos, Telerik, or IIS, and whether those products are fully patched against known remote-code-execution flaws. Review IIS for unfamiliar modules, and Linux systems for unpatched kernels vulnerable to Dirty Pipe.

Apply the latest security updates for Zimbra, AjaxPro, Nacos, Telerik, and IIS, patch Linux kernels against Dirty Pipe, and watch for unexpected scheduled tasks, new accounts, unfamiliar IIS modules, and outbound connections from these servers.

Technical details

Affected software: Zimbra, AjaxPro, Nacos, Telerik, Dirty Pipe, BadIIS

UAT-10147 finds an internet-facing server running one of several vulnerable products, including Zimbra, AjaxPro, Nacos, or Telerik, and exploits a known remote-code-execution flaw in it to get in. On Windows servers the group uses that access to install BadIIS, a malicious add-on for Microsoft's web server software that manipulates search results, then runs scripts to gain higher-privilege access and weaken security scanning around it. On Linux servers the group plants a web shell first, then uses a local flaw called Dirty Pipe to reach full root control and install more implants.

UAT-10147 chains public RCE exploits (Zimbra, AjaxPro, Nacos, Telerik) with AI-generated playbooks covering exploitation, privilege escalation, validation, and persistence. On Windows, post-exploitation includes deploying BadIIS (a malicious IIS module used for SEO/search-result manipulation), privilege escalation, and weakening Windows Defender exclusions around IIS paths. On Linux, operators drop a web shell then use local privilege-escalation bugs including Dirty Pipe (CVE-2022-0847) to reach root.

Talos also documented an AI-produced workflow for abusing ASP.NET ViewState deserialization using stolen MachineKey material, and use of a cloud configuration service to harvest victim details post-Nacos-exploitation. A linked server held roughly 170,000 target URLs.

References

View Original Source