---
schema: 1
kind: research
title: "An intrusion crew's AI-written playbook records why time-based blind testing fails against ViewState deserialization — and that a successful exploit returns HTTP 500, which is what most error-rate alerting is tuned to ignore"
headline: "Talos recovered the attacker's own generated tradecraft notes from an open directory, and the most useful page is the one explaining how they confirm execution"
summary: >
  Cisco Talos published a companion analysis on 2026-08-20 to its SPECTRE implant research, covering
  how the same Chinese-speaking actor, UAT-10147, uses agentic AI across the exploitation lifecycle
  rather than for scripting help. Talos recovered the actor's own operational artifacts from an open
  directory on a download server: a target list of roughly 170,000 URLs split into seventeen batches,
  an AI-generated nine-section playbook for ASP.NET ViewState deserialization attacks, and four
  companion Python scripts automating write-capability checks, implant deployment, web-shell staging
  and reconnaissance. Two findings in that playbook are directly useful to defenders regardless of this
  actor: time-based blind testing cannot confirm ViewState code execution because the launch call
  returns immediately, pushing the actor to out-of-band callbacks instead; and a successful exploit
  surfaces as an HTTP 500 with a cast exception, so alerting that treats 5xx responses as noise misses
  the successful attempts specifically.
discovered_at: "2026-08-23T05:00:00Z"
event_date: "2026-08-20"
run_id: 2026-08-23T0409Z-intel
priority: notable
immediate_action: null
tags: [ai-abuse, organized-crime, rce, pre-auth, vulnerabilities]
regions: [global, europe]
sectors: [public-sector, education, media, technology]
entities: [actor:uat-10147, tool:pentestgpt, tool:deepaudit]
techniques: [T1190, T1068, T1505.003, T1053.005, T1136.001, T1685, T1105, T1027, T1071.001]
affected_products: ["Zimbra Collaboration Suite", "Progress Telerik UI for ASP.NET AJAX", "Alibaba Nacos", "Microsoft Internet Information Services", "Microsoft Windows Defender"]
cves: []
sources:
  - url: "https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/"
    publisher: "Cisco Talos"
    date: "2026-08-20"
    role: primary
closed_sources: []
evidence:
  - quote: "Talos assesses with moderate-to-high confidence that UAT-10147 is among an emerging class of financially motivated intrusion operators leveraging agentic AI systems to operationalize offensive tradecraft at scale."
    publisher: "Cisco Talos"
  - quote: "Time-based blind testing (e.g., ping -n 10 or timeout /t 10) is entirely ineffective for confirming ViewState RCE."
    publisher: "Cisco Talos"
  - quote: "Because Process.Start() is asynchronous and returns immediately, no execution delay is observable from the HTTP response."
    publisher: "Cisco Talos"
  - quote: "This inverted success condition is a defensive blind spot: network monitoring tools that alert on 5xx responses may generate excessive noise, while the actual exploit succeeds silently in the error stream."
    publisher: "Cisco Talos"
verification: single-source
sourcing_note: >
  Cisco Talos is the sole assessor, and its confidence wording is carried as stated rather than
  flattened — the campaign-level agentic-AI assessment is moderate-to-high confidence, while the
  narrower claim about the source-code scanning framework's intended use is high confidence. The
  vulnerabilities the actor exploits are all long-patched public CVEs named in Talos's own text and are
  described in the body rather than recorded in this entry's cves[] list, because none is a new or
  in-window disclosure and recording them would put historical ids into this store's CVE surface as if
  they were this run's findings. Talos labels the Zimbra flaw an unauthenticated remote code execution
  path without naming the companion authentication-bypass flaw that historically completed that chain;
  this entry carries Talos's characterisation as Talos states it rather than supplying a second
  identifier no cited source mentions. The article's coverage section lists vendor signature names and
  network rule identifiers, which this entry does not reproduce.
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: B
  credibility: 2
watchlist_hit: false
actions:
  - "Check whether your web-application and WAF alerting suppresses or down-ranks HTTP 500 responses on ASP.NET endpoints — against ViewState deserialization the 500 with a cast exception is the success signal, so blanket 5xx suppression hides exactly the attempts that worked."
migrated_from: null
---

Cisco Talos's companion piece to its SPECTRE implant analysis, published the same day, covers how UAT-10147 works rather than what it deploys, and it is unusually well-evidenced because the actor left an open, browsable directory on a download server holding its own operational material ([Cisco Talos, 2026-08-20](https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/)). That in itself is a reminder worth a sentence: an operator's exposed staging directory remains one of the richest intelligence sources available, and Talos found the campaign by following a compromised host's traffic to it. Talos's assessment is stated at its own confidence level: *"Talos assesses with moderate-to-high confidence that UAT-10147 is among an emerging class of financially motivated intrusion operators leveraging agentic AI systems to operationalize offensive tradecraft at scale."*

**Scale and target selection.** The recovered material includes roughly 170,000 candidate URLs, which the actor had split into seventeen files of about ten thousand each because scanning the whole list at once was inefficient. Initial access is mass exploitation of long-public flaws rather than anything novel: a Zimbra Collaboration Suite flaw Talos labels an unauthenticated remote code execution path (CVE-2022-27925), an AjaxPro deserialization flaw (CVE-2021-23758), a pair of Nacos flaws chaining an authentication bypass into script-engine code execution (CVE-2021-29441 and CVE-2021-29442), and the well-known Telerik UI for ASP.NET AJAX deserialization flaw (CVE-2019-18935). A Linux privilege-escalation set covers Dirty Pipe, Baron Samedit and four older kernel and utility flaws. Every one is years old and patched; the novelty is entirely in the automation wrapped around them.

**The finding that transfers.** The AI-generated playbook is a nine-section document for ViewState deserialization attacks, and its most defender-relevant passage is a lesson the actor learned the hard way. Talos quotes it directly: *"Time-based blind testing (e.g., ping -n 10 or timeout /t 10) is entirely ineffective for confirming ViewState RCE."* The reason follows in the next sentence: *"Because Process.Start() is asynchronous and returns immediately, no execution delay is observable from the HTTP response."* Having established that, the playbook pivots to out-of-band confirmation — HTTP callbacks issued through the certificate utility or PowerShell, and DNS lookups polled against a public webhook service — to establish that code ran.

The second half of that lesson is the one to act on. The playbook records that a *successful* ViewState exploitation attempt returns an HTTP 500 carrying a cast exception, which proves the signing key was correct and the payload deserialized. Talos states the consequence plainly: *"This inverted success condition is a defensive blind spot: network monitoring tools that alert on 5xx responses may generate excessive noise, while the actual exploit succeeds silently in the error stream."* Most mature web-monitoring configurations suppress or aggregate 5xx noise precisely because it is noisy; against this technique that suppression removes the successful attempts and leaves the failures.

**Post-exploitation.** Four AI-generated Python scripts automate baseline write-capability testing, web-root permission enumeration and physical-path discovery through the IIS management utility, implant deployment with post-transfer verification of file presence and size, two-step web-shell staging, and encoded reconnaissance. Privilege escalation uses a renamed potato-family binary staged under an innocuous archive name. The actor then adds both IIS module directories to Defender's exclusion list, redundantly — once through the PowerShell preference cmdlet and once by writing the exclusion paths directly into the registry — before dropping its search-fraud module, creating a rogue local account placed in both the Administrators and Remote Desktop Users groups, and registering a deceptive scheduled task named after a browser start routine, set to run at every logon with highest privileges. Talos names two AI tools installed on the actor's own management server. The first is DeepAudit, a source-code vulnerability-scanning framework, of which it says *"Consequently, we assess with high confidence that they intend to use it to identify vulnerabilities within target website source code or third-party package libraries"* — a higher confidence than the campaign-level assessment, and worth keeping distinct from it. The second is PentestGPT, an AI-driven penetration-testing tool used to scan web servers and run proof-of-concept exploits. Victims named span government, university, media, technology and gaming organisations in Brazil, Bolivia, China, Canada and Vietnam.

**Defender takeaway:** nothing here requires a patch that is not already years available, which is the point — the automation compresses the time between a vulnerable host existing and being exploited, so an unpatched Telerik, Zimbra or Nacos instance that survived on obscurity has less runway than it did. The two concrete changes are in monitoring rather than patching: treat HTTP 500 with a deserialization or cast exception on an ASP.NET endpoint as a success indicator rather than noise, and watch for the Defender exclusion write itself — adding a web-server module directory to an antivirus exclusion list is a step with essentially no legitimate counterpart on a production IIS host, and it happens here through two different mechanisms, so covering only the PowerShell cmdlet misses the registry path. **Triage:** administrators do legitimately add exclusions and do legitimately create scheduled tasks, so the discriminators are the target of the exclusion (a web-server binary directory rather than an application data path), the redundancy of two write mechanisms in quick succession, and whether the account performing it is one that ordinarily administers that host.