2026-08-23 · view entry permalink →
An intrusion crew's AI-written playbook records why time-based blind testing fails against ViewState deserialization, and that a successful exploit returns HTTP 500, which is what most error-rate alerting is tuned to ignore
Cisco Talos's companion piece to its SPECTRE implant analysis, published the same day, covers how UAT-10147 works rather than what it deploys, and it is unusually well-evidenced because the actor left an open, browsable directory on a download server holding its own operational material (Cisco Talos, 2026-08-20). That in itself is a reminder worth a sentence: an operator's exposed staging directory remains one of the richest intelligence sources available, and Talos found the campaign by following a compromised host's traffic to it. Talos's assessment is stated at its own confidence level: "Talos assesses with moderate-to-high confidence that UAT-10147 is among an emerging class of financially motivated intrusion operators leveraging agentic AI systems to operationalize offensive tradecraft at scale."
Scale and target selection. The recovered material includes roughly 170,000 candidate URLs, which the actor had split into seventeen files of about ten thousand each because scanning the whole list at once was inefficient. Initial access is mass exploitation of long-public flaws rather than anything novel: a Zimbra Collaboration Suite flaw Talos labels an unauthenticated remote code execution path (CVE-2022-27925), an AjaxPro deserialization flaw (CVE-2021-23758), a pair of Nacos flaws chaining an authentication bypass into script-engine code execution (CVE-2021-29441 and CVE-2021-29442), and the well-known Telerik UI for ASP.NET AJAX deserialization flaw (CVE-2019-18935). A Linux privilege-escalation set covers Dirty Pipe, Baron Samedit and four older kernel and utility flaws. Every one is years old and patched; the novelty is entirely in the automation wrapped around them.
The finding that transfers. The AI-generated playbook is a nine-section document for ViewState deserialization attacks, and its most defender-relevant passage is a lesson the actor learned the hard way. Talos quotes it directly: "Time-based blind testing (e.g., ping -n 10 or timeout /t 10) is entirely ineffective for confirming ViewState RCE." The reason follows in the next sentence: "Because Process.Start() is asynchronous and returns immediately, no execution delay is observable from the HTTP response." Having established that, the playbook pivots to out-of-band confirmation (HTTP callbacks issued through the certificate utility or PowerShell, and DNS lookups polled against a public webhook service) to establish that code ran.
The second half of that lesson is the one to act on. The playbook records that a successful ViewState exploitation attempt returns an HTTP 500 carrying a cast exception, which proves the signing key was correct and the payload deserialized. Talos states the consequence plainly: "This inverted success condition is a defensive blind spot: network monitoring tools that alert on 5xx responses may generate excessive noise, while the actual exploit succeeds silently in the error stream." Most mature web-monitoring configurations suppress or aggregate 5xx noise precisely because it is noisy; against this technique that suppression removes the successful attempts and leaves the failures.
Post-exploitation. Four AI-generated Python scripts automate baseline write-capability testing, web-root permission enumeration and physical-path discovery through the IIS management utility, implant deployment with post-transfer verification of file presence and size, two-step web-shell staging, and encoded reconnaissance. Privilege escalation uses a renamed potato-family binary staged under an innocuous archive name. The actor then adds both IIS module directories to Defender's exclusion list, redundantly (once through the PowerShell preference cmdlet and once by writing the exclusion paths directly into the registry) before dropping its search-fraud module, creating a rogue local account placed in both the Administrators and Remote Desktop Users groups, and registering a deceptive scheduled task named after a browser start routine, set to run at every logon with highest privileges. Talos names two AI tools installed on the actor's own management server. The first is DeepAudit, a source-code vulnerability-scanning framework, of which it says "Consequently, we assess with high confidence that they intend to use it to identify vulnerabilities within target website source code or third-party package libraries", a higher confidence than the campaign-level assessment, and worth keeping distinct from it. The second is PentestGPT, an AI-driven penetration-testing tool used to scan web servers and run proof-of-concept exploits. Victims named span government, university, media, technology and gaming organisations in Brazil, Bolivia, China, Canada and Vietnam.
Talos assesses with moderate-to-high confidence that UAT-10147 is among an emerging class of financially motivated intrusion operators leveraging agentic AI systems to operationalize offensive tradecraft at scale.
Time-based blind testing (e.g., ping -n 10 or timeout /t 10) is entirely ineffective for confirming ViewState RCE.
Because Process.Start() is asynchronous and returns immediately, no execution delay is observable from the HTTP response.
This inverted success condition is a defensive blind spot: network monitoring tools that alert on 5xx responses may generate excessive noise, while the actual exploit succeeds silently in the error stream.