UAT-10147 Deploys SPECTRE Cross-Platform Backdoor

UAT-10147 is a Chinese-speaking threat actor targeting internet-facing IIS and Linux servers to conduct SEO fraud and establish persistent access. The actor utilizes a newly identified, custom-developed backdoor called SPECTRE, which demonstrates significant cross-platform capabilities. The malware is notable for its integration of AI-assisted code generation, robust anti-analysis scoring routines, and advanced defense evasion, including Bring Your Own Virtual Driver (BYOVD) to neutralize EDR solutions and custom Linux kernel rootkits.

The SPECTRE implant employs custom obfuscation techniques, including PEB hash walking for API resolution and a per-string xorshift32 PRNG scheme for encryption. Configuration management for the backdoor is uniquely handled via NTFS Alternate Data Streams (ADS) on Windows systems to maintain persistence and C2 agility. The actor's operational maturity is further highlighted by the use of web shells with covert headers ("X-ID") and SEO fraud utilities, indicating a persistent, monetized post-compromise ecosystem.

Attack Chain

1. Initial exploitation of internet-facing IIS or Linux servers, likely leveraging AI-assisted vulnerability research.
2. Deployment of the SPECTRE backdoor or secondary web shells (e.g., ASHX SEO engine) to establish initial foothold.
3. Execution of the SPECTRE implant, which performs a local anti-analysis environment check to ensure it is not running in a sandbox or hardened system.
4. Establishment of C2 communication channels using HTTP POST requests to "/api/v1/register" and "/api/v1/output" with covert "X-ID" headers.
5. Persistence and configuration updates performed by reading/writing to NTFS Alternate Data Streams (ADS) located at "C:\Windows\System32\drivers\etc\hosts:cache".
6. Deployment of BYOVD components or Linux kernel rootkits to neutralize security software and gain kernel-level control.
7. Execution of credential theft and process injection modules to expand control over the target infrastructure.
8. Final objective: long-term persistence for SEO fraud monetization and persistent access to server resources.

Impact

UAT-10147's activity results in compromised internet-facing servers, leading to unauthorized control, potential data exfiltration, and the subversion of server resources for SEO fraud campaigns. The use of kernel-level rootkits and BYOVD techniques significantly complicates incident response and remediation, as traditional EDR protections are explicitly targeted for neutralization.

Recommendation

• Enable Sysmon FileCreate and ProcessCreation logging to detect modifications to NTFS Alternate Data Streams (ADS), specifically targeting the "C:\Windows\System32\drivers\etc\hosts:cache" path.
• Implement network-based monitoring for inbound HTTP POST requests containing custom headers such as "X-ID" to identify C2 communication.
• Deploy detections for BYOVD attacks by monitoring the loading of vulnerable/unsigned drivers known to be abused for EDR neutralization.
• Review all IIS web directories for unauthorized ASHX files or SEO-related configuration artifacts associated with UAT-10147.