An intrusion crew's AI-written playbook records why time-based blind testing fails against ViewState deserialization — and that a successful exploit returns HTTP 500, which is what most error-rate alerting is tuned to ignore
Cisco Talos's companion piece to its SPECTRE implant analysis, published the same day, covers how UAT-10147 works rather than what it deploys, and it is unusually well-evidenced because the actor left an open, browsable directory on a download server holding its own operational material (Cisco Talos, 2026-08-20). That in itself is a reminder worth a sentence: an operator's exposed staging directory remains one of the richest intelligence sources available, and Talos found the campaign by following a compromised host's traffic to it. Talos's assessment is stated at its own confidence level: "Talos assesses with moderate-to-high confidence that UAT-10147 is among an emerging class of financially motivated intrusion operators leveraging agentic AI systems to operationalize offensive tradecraft at scale."
Scale and target selection. The recovered material includes roughly 170,000 candidate URLs, which the actor had split into seventeen files of about ten thousand each because scanning the whole list at once was inefficient. Initial access is mass exploitation of long-public flaws rather than anything novel: a Zimbra Collaboration Suite flaw Talos labels an unauthenticated remote code execution path (CVE-2022-27925), an AjaxPro deserialization flaw (CVE-2021-23758), a pair of Nacos flaws chaining an authentication bypass into script-engine code execution (CVE-2021-29441 and CVE-2021-29442), and the well-known Telerik UI for ASP.NET AJAX deserialization flaw (CVE-2019-18935). A Linux privilege-escalation set covers Dirty Pipe, Baron Samedit and four older kernel and utility flaws. Every one is years old and patched; the novelty is entirely in the automation wrapped around them.
The finding that transfers. The AI-generated playbook is a nine-section document for ViewState deserialization attacks, and its most defender-relevant passage is a lesson the actor learned the hard way. Talos quotes it directly: "Time-based blind testing (e.g., ping -n 10 or timeout /t 10) is entirely ineffective for confirming ViewState RCE." The reason follows in the next sentence: "Because Process.Start() is asynchronous and returns immediately, no execution delay is observable from the HTTP response." Having established that, the playbook pivots to out-of-band confirmation — HTTP callbacks issued through the certificate utility or PowerShell, and DNS lookups polled against a public webhook service — to establish that code ran.
The second half of that lesson is the one to act on. The playbook records that a successful ViewState exploitation attempt returns an HTTP 500 carrying a cast exception, which proves the signing key was correct and the payload deserialized. Talos states the consequence plainly: "This inverted success condition is a defensive blind spot: network monitoring tools that alert on 5xx responses may generate excessive noise, while the actual exploit succeeds silently in the error stream." Most mature web-monitoring configurations suppress or aggregate 5xx noise precisely because it is noisy; against this technique that suppression removes the successful attempts and leaves the failures.
Post-exploitation. Four AI-generated Python scripts automate baseline write-capability testing, web-root permission enumeration and physical-path discovery through the IIS management utility, implant deployment with post-transfer verification of file presence and size, two-step web-shell staging, and encoded reconnaissance. Privilege escalation uses a renamed potato-family binary staged under an innocuous archive name. The actor then adds both IIS module directories to Defender's exclusion list, redundantly — once through the PowerShell preference cmdlet and once by writing the exclusion paths directly into the registry — before dropping its search-fraud module, creating a rogue local account placed in both the Administrators and Remote Desktop Users groups, and registering a deceptive scheduled task named after a browser start routine, set to run at every logon with highest privileges. Talos names two AI tools installed on the actor's own management server. The first is DeepAudit, a source-code vulnerability-scanning framework, of which it says "Consequently, we assess with high confidence that they intend to use it to identify vulnerabilities within target website source code or third-party package libraries" — a higher confidence than the campaign-level assessment, and worth keeping distinct from it. The second is PentestGPT, an AI-driven penetration-testing tool used to scan web servers and run proof-of-concept exploits. Victims named span government, university, media, technology and gaming organisations in Brazil, Bolivia, China, Canada and Vietnam.
Talos assesses with moderate-to-high confidence that UAT-10147 is among an emerging class of financially motivated intrusion operators leveraging agentic AI systems to operationalize offensive tradecraft at scale.
Time-based blind testing (e.g., ping -n 10 or timeout /t 10) is entirely ineffective for confirming ViewState RCE.
Because Process.Start() is asynchronous and returns immediately, no execution delay is observable from the HTTP response.
This inverted success condition is a defensive blind spot: network monitoring tools that alert on 5xx responses may generate excessive noise, while the actual exploit succeeds silently in the error stream.
Defender actions
- Check whether your web-application and WAF alerting suppresses or down-ranks HTTP 500 responses on ASP.NET endpoints — against ViewState deserialization the 500 with a cast exception is the success signal, so blanket 5xx suppression hides exactly the attempts that worked.
ATT&CK mapping
9 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Execution TA0002
T1053.005Scheduled Task/Job: Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.
Persistence TA0003
T1053.005Scheduled Task/Job: Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.
T1136.001Create Account: Local Account
Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
T1505.003Server Software Component: Web Shell
Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.
Privilege Escalation TA0004
T1053.005Scheduled Task/Job: Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.
T1068Exploitation for Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Stealth TA0005
T1027Obfuscated Files or Information
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Defense Impairment TA0112
T1685Disable or Modify Tools
Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.
Command and Control TA0011
T1071.001Application Layer Protocol: Web Protocols
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
T1105Ingress Tool Transfer
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.