SPECTRE unlinks EDR's kernel callbacks one at a time using a two-driver BYOVD toolkit and an offset table for thirteen Windows builds — and its Linux half hides through ftrace rather than the syscall table

Cisco Talos published an analysis on 2026-08-20 of SPECTRE, a cross-platform C backdoor run by a Chinese-speaking intrusion actor it designates UAT-10147, which compromises internet-facing IIS and Linux web servers and monetises them through search-engine fraud (Cisco Talos, 2026-08-20). The Windows build implements 45 commands, the Linux build 29. The interesting half is not the command set but how each variant makes itself unobservable, and both answers are instructive for tooling choices rather than for signature lists.

Blinding the endpoint on Windows. SPECTRE downloads one of two long-known vulnerable drivers from its command-and-control server — MSI's RTCore64.sys (CVE-2019-16098) or Dell's DBUtil_2_3.sys (CVE-2021-21551) — writes it to the temporary directory, installs it as a transient kernel service through the Service Control Manager, and opens a device handle to it. Neither is a new flaw; both are being reused as an arbitrary kernel read/write primitive. With that primitive it locates the kernel image in memory through a documented system-information call, then consults a hardcoded offset table covering thirteen Windows versions to compute where the notification-callback arrays live, and performs targeted writes: "By performing targeted kernel writes, the SPECTRE safely unlinks each registered EDR callback from its doubly-linked list". The three callback classes it removes are process creation, thread creation and image load — the events most endpoint products depend on to see anything happen at all. Talos names the affected class as "kernel-callback-dependent security products such as CrowdStrike Falcon, SentinelOne, Microsoft Defender", alongside other unnamed vendors. The blinding lasts for the remainder of the session, which matters for response scoping: it is not a permanent modification, and a reboot restores callback registration, but everything the implant does after that point produced no callback-derived telemetry.

Execution, privilege and credentials. Talos also documents the implant's injection tradecraft — standard process hollowing, targeting a common Windows service host by default, and an asynchronous-procedure-call injection variant executed early in a target process's lifetime. Escalation is named-pipe impersonation — the implant creates a pipe under a predictable per-thread name and acquires a SYSTEM token from a client that connects to it. Credential access is then deliberately built to avoid the one place defenders watch hardest: with SYSTEM in hand it saves the SAM, SYSTEM and SECURITY registry hives to disk for offline hash extraction, enumerates stored Windows credentials by capturing the output of the built-in credential-manager listing utility — Talos emphasises this happens without any LSASS access — and copies Chrome and Edge login-data and local-state files for offline DPAPI decryption with a named public post-exploitation tool. No process ever opens a handle to LSASS, so a detection strategy anchored on LSASS access sees none of it.

Command-and-control that survives blocking. The C2 configuration is stored in an alternate data stream on the Windows hosts file. Talos's framing of why: "This strategy allows the threat actor to easily update the C2 configuration by modifying the ADS, thereby circumventing firewall blocklists without needing to recompile the binary." The evasion value is specifically against static, hash-keyed and recompile-triggered detection rather than against telemetry that observes stream creation.

The Linux half. Persistence is a systemd unit presenting itself as a hardware performance monitor, and the detail worth carrying is its ordering directive: the unit is configured to start before the system initialisation target, which Talos states ensures the rootkit loads on every boot ahead of any security tooling. The kernel module masquerades as the legitimate ACPI processor power-management module. Hiding is implemented through ftrace with the instruction-pointer-modify flag, redirecting six entry points covering TCP socket enumeration for both IPv4 and IPv6, the three signal-delivery syscalls and directory enumeration. Talos's own explanation of why this choice matters: because ftrace is a legitimate kernel debugging interface, hooking through it produces minimal noise in kernel integrity checks — which is to say it specifically defeats tools that watch the syscall table for patching but do not watch ftrace registration state. Control is exercised by sending signals to a magic process id: one signal unlinks a task structure from the kernel process list so its /proc entry disappears, another unlinks the module itself from the kernel module list so it vanishes from module listings, a third rewrites the calling process's credential structure to grant it root, and a fourth serves as a module-load acknowledgement handshake.

On the AI claim, at the source's own confidence. Talos makes three separate and differently-hedged statements here, and they should not be collapsed. Scoped to the Linux rootkit's source code specifically, it states: "Talos investigated the source code of the Specter rootkit and assesses with medium confidence that UAT-10147 leveraged a combination of AI-assisted development and human expertise in the creation of this rootkit, which is designed to be invoked directly by SPECTRE." It rests that on four observations — an opening comment block that reads like a generated feature list narrating what the code is about to do, decorative separators of machine-like uniformity across more than ten sections, pedagogical inline comments explaining basic kernel concepts a developer would not explain to themselves, and three redundant implementations explicitly labelled as alternative methods where a human targeting one kernel would pick one. That last observation is the most portable: producing every known approach rather than selecting one is a completeness reflex, and it is a heuristic that works independently of this actor. Separately and without a confidence qualifier, Talos assesses the actor is gradually incorporating AI-assisted development more broadly, extending the suggestion to the SPECTRE backdoor itself without the same enumerated evidence. And separately again, build-path strings inside the actor's custom privilege-escalation tools reference an "AI" directory, which Talos describes only as strongly suggesting AI assistance in developing those tools — weaker wording, different tools, and not part of the medium-confidence rootkit assessment.