PentestGPT

tool · tool:pentestgpt single-source

AI-driven penetration-testing tool observed by Cisco Talos installed on UAT-10147's command-and-control server and used to dynamically scan web servers and execute proof-of-concept exploits (Cisco Talos, 2026-08-20).

Coverage

first 2026-08-23 → last 2026-08-23

Latest activity

2026-08-23

Talos recovered the attacker's own generated tradecraft notes from an open directory, and the most useful…

Peak priority

notable

1 notable

Targets

public-sector

sectors: public-sector, education, media · regions: europe

Sources cited

1 hosts

Action items (1)

Do-now tasks recorded on the entries about PentestGPT, newest first. Check the date before acting on an older one.

Check whether your web-application and WAF alerting suppresses or down-ranks HTTP 500 responses on ASP.NET endpoints; against ViewState deserialization the 500 with a cast exception is the success signal, so blanket 5xx suppression hides exactly the attempts that worked.
2026-08-23Talos recovered the attacker's own generated…

Defender insights

What each entry about PentestGPT tells a defender to do, newest first.

2026-08-23NOTABLETalos recovered the attacker's own generated tradecraft notes from an open directory, and the most useful page is the one explaining how they confirm execution

Defender takeaway

Triage

Story timeline

2026-08-23An intrusion crew's AI-written playbook records why time-based blind testing fails against ViewState deserialization, and that a successful exploit returns HTTP 500, which is what most error-rate alerting is tuned to ignore
researchTalos recovered the attacker's own generated tradecraft notes from an open directory, and the most useful page is the one explaining how they confirm execution

Hunting pivots

Affected products

Alibaba Nacos Microsoft Internet Information Services Microsoft Windows Defender Progress Telerik UI for ASP.NET AJAX Zimbra Collaboration Suite

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-08-23/uat-10147-agentic-ai-exploitation-oob-confirmation · ATT&CK page ↗

Execution TA0002

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-08-23/uat-10147-agentic-ai-exploitation-oob-confirmation · ATT&CK page ↗

Persistence TA0003

T1053.005Scheduled Task/Job: Scheduled Task×1

Evidence: 2026-08-23/uat-10147-agentic-ai-exploitation-oob-confirmation · ATT&CK page ↗

T1136.001Create Account: Local Account×1

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

Evidence: 2026-08-23/uat-10147-agentic-ai-exploitation-oob-confirmation · ATT&CK page ↗

T1505.003Server Software Component: Web Shell×1

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

Evidence: 2026-08-23/uat-10147-agentic-ai-exploitation-oob-confirmation · ATT&CK page ↗

Privilege Escalation TA0004

T1053.005Scheduled Task/Job: Scheduled Task×1

Evidence: 2026-08-23/uat-10147-agentic-ai-exploitation-oob-confirmation · ATT&CK page ↗

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-08-23/uat-10147-agentic-ai-exploitation-oob-confirmation · ATT&CK page ↗

Stealth TA0005

T1027Obfuscated Files or Information×1

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-08-23/uat-10147-agentic-ai-exploitation-oob-confirmation · ATT&CK page ↗

Defense Impairment TA0112

T1685Disable or Modify Tools×1

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Evidence: 2026-08-23/uat-10147-agentic-ai-exploitation-oob-confirmation · ATT&CK page ↗

Command and Control TA0011

T1071.001Application Layer Protocol: Web Protocols×1

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-08-23/uat-10147-agentic-ai-exploitation-oob-confirmation · ATT&CK page ↗

T1105Ingress Tool Transfer×1

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

Evidence: 2026-08-23/uat-10147-agentic-ai-exploitation-oob-confirmation · ATT&CK page ↗

Entries about PentestGPT (1)

2026-08-23 · view entry permalink →

NOTABLENATOB2

An intrusion crew's AI-written playbook records why time-based blind testing fails against ViewState deserialization, and that a successful exploit returns HTTP 500, which is what most error-rate alerting is tuned to ignore

Cisco Talos's companion piece to its SPECTRE implant analysis, published the same day, covers how UAT-10147 works rather than what it deploys, and it is unusually well-evidenced because the actor left an open, browsable directory on a download server holding its own operational material (Cisco Talos, 2026-08-20). That in itself is a reminder worth a sentence: an operator's exposed staging directory remains one of the richest intelligence sources available, and Talos found the campaign by following a compromised host's traffic to it. Talos's assessment is stated at its own confidence level: "Talos assesses with moderate-to-high confidence that UAT-10147 is among an emerging class of financially motivated intrusion operators leveraging agentic AI systems to operationalize offensive tradecraft at scale."

Scale and target selection. The recovered material includes roughly 170,000 candidate URLs, which the actor had split into seventeen files of about ten thousand each because scanning the whole list at once was inefficient. Initial access is mass exploitation of long-public flaws rather than anything novel: a Zimbra Collaboration Suite flaw Talos labels an unauthenticated remote code execution path (CVE-2022-27925), an AjaxPro deserialization flaw (CVE-2021-23758), a pair of Nacos flaws chaining an authentication bypass into script-engine code execution (CVE-2021-29441 and CVE-2021-29442), and the well-known Telerik UI for ASP.NET AJAX deserialization flaw (CVE-2019-18935). A Linux privilege-escalation set covers Dirty Pipe, Baron Samedit and four older kernel and utility flaws. Every one is years old and patched; the novelty is entirely in the automation wrapped around them.

The finding that transfers. The AI-generated playbook is a nine-section document for ViewState deserialization attacks, and its most defender-relevant passage is a lesson the actor learned the hard way. Talos quotes it directly: "Time-based blind testing (e.g., ping -n 10 or timeout /t 10) is entirely ineffective for confirming ViewState RCE." The reason follows in the next sentence: "Because Process.Start() is asynchronous and returns immediately, no execution delay is observable from the HTTP response." Having established that, the playbook pivots to out-of-band confirmation (HTTP callbacks issued through the certificate utility or PowerShell, and DNS lookups polled against a public webhook service) to establish that code ran.

The second half of that lesson is the one to act on. The playbook records that a successful ViewState exploitation attempt returns an HTTP 500 carrying a cast exception, which proves the signing key was correct and the payload deserialized. Talos states the consequence plainly: "This inverted success condition is a defensive blind spot: network monitoring tools that alert on 5xx responses may generate excessive noise, while the actual exploit succeeds silently in the error stream." Most mature web-monitoring configurations suppress or aggregate 5xx noise precisely because it is noisy; against this technique that suppression removes the successful attempts and leaves the failures.

Post-exploitation. Four AI-generated Python scripts automate baseline write-capability testing, web-root permission enumeration and physical-path discovery through the IIS management utility, implant deployment with post-transfer verification of file presence and size, two-step web-shell staging, and encoded reconnaissance. Privilege escalation uses a renamed potato-family binary staged under an innocuous archive name. The actor then adds both IIS module directories to Defender's exclusion list, redundantly (once through the PowerShell preference cmdlet and once by writing the exclusion paths directly into the registry) before dropping its search-fraud module, creating a rogue local account placed in both the Administrators and Remote Desktop Users groups, and registering a deceptive scheduled task named after a browser start routine, set to run at every logon with highest privileges. Talos names two AI tools installed on the actor's own management server. The first is DeepAudit, a source-code vulnerability-scanning framework, of which it says "Consequently, we assess with high confidence that they intend to use it to identify vulnerabilities within target website source code or third-party package libraries", a higher confidence than the campaign-level assessment, and worth keeping distinct from it. The second is PentestGPT, an AI-driven penetration-testing tool used to scan web servers and run proof-of-concept exploits. Victims named span government, university, media, technology and gaming organisations in Brazil, Bolivia, China, Canada and Vietnam.

Defender takeaway

Nothing here requires a patch that is not already years available, which is the point; the automation compresses the time between a vulnerable host existing and being exploited, so an unpatched Telerik, Zimbra or Nacos instance that survived on obscurity has less runway than it did. The two concrete changes are in monitoring rather than patching: treat HTTP 500 with a deserialization or cast exception on an ASP.NET endpoint as a success indicator rather than noise, and watch for the Defender exclusion write itself, adding a web-server module directory to an antivirus exclusion list is a step with essentially no legitimate counterpart on a production IIS host, and it happens here through two different mechanisms, so covering only the PowerShell cmdlet misses the registry path. Triage: administrators do legitimately add exclusions and do legitimately create scheduled tasks, so the discriminators are the target of the exclusion (a web-server binary directory rather than an application data path), the redundancy of two write mechanisms in quick succession, and whether the account performing it is one that ordinarily administers that host.

Talos assesses with moderate-to-high confidence that UAT-10147 is among an emerging class of financially motivated intrusion operators leveraging agentic AI systems to operationalize offensive tradecraft at scale.

Time-based blind testing (e.g., ping -n 10 or timeout /t 10) is entirely ineffective for confirming ViewState RCE.

Because Process.Start() is asynchronous and returns immediately, no execution delay is observable from the HTTP response.

This inverted success condition is a defensive blind spot: network monitoring tools that alert on 5xx responses may generate excessive noise, while the actual exploit succeeds silently in the error stream.

Cisco Talos 2026-08-20

research23 Aug 05:00Zsingle-sourceOpen finding →

Sources: Cisco Talos

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Alibaba Nacos×1
productproduct:alibaba-nacos
DeepAudit×1
tooltool:deepaudit
Microsoft Defender Antivirus×1
productproduct:microsoft-defender-antivirus
Microsoft Internet Information Services×1
productproduct:microsoft-internet-information-services
Progress Telerik UI for ASP.NET AJAX×1
productproduct:progress-telerik-ui-for-asp-net-ajax
SPECTRE×1
malwaremalware:spectre-uat10147
UAT-10147×1
actoractor:uat-10147
Zimbra Collaboration×1
productproduct:zimbra-collaboration

Where this entity is cited

Research1

Source distribution

blog.talosintelligence.com1 (100%)

All cited sources (1)

blog.talosintelligence.comCisco Taloshttps://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/
source profile · cited in 2026-08-23