# SPECTRE Malware: UAT-10147 Targets IIS, Linux Servers with Rootkits

> Chinese-speaking actor UAT-10147 deploys SPECTRE, a cross-platform implant featuring Linux rootkit and BYOVD EDR bypass capabilities.

- Published: 2026-08-20T16:27:35.000Z
- Severity: high
- Category: Threat Intel
- Tags: Malware, Linux Rootkit, BYOVD, UAT 10147, SPECTRE
- Author: Runtime Rebel Intel
- Primary source: https://blog.talosintelligence.com/uat-10147-deploys-spectre-a-cross-platform-implant-with-linux-rootkit-and-byovd-capabilities/
- Canonical: https://runtimerebel.com/blog/spectre-malware-uat-10147-targets-iis-linux-servers-with-rootkits

## Key points

- Chinese-speaking actor UAT-10147 uses SPECTRE, a cross-platform implant, to compromise IIS and Linux servers at scale.
- Internet-facing Microsoft IIS and Linux servers are primary targets for SPECTRE deployment.
- Implement strong EDR, regularly patch all internet-facing servers, and monitor for unusual activity.

## UAT-10147 Deploys SPECTRE: Advanced Cross-Platform Implant 

Cisco Talos has uncovered a sophisticated multi-platform post-exploitation ecosystem operated by UAT-10147, a highly capable Chinese-speaking intrusion actor. This [threat actor](/glossary#threat-actor) is leveraging the newly identified SPECTRE implant, a cross-platform [backdoor](/glossary#backdoor) targeting both Internet Information Services (IIS) and Linux servers. SPECTRE integrates advanced capabilities, including cross-platform command-and-control ([C2](/glossary#c2)) operations, process injection, [credential theft](/glossary#credential-theft), anti-analysis protections, and kernel-level [endpoint](/glossary#endpoint) detection and response ([EDR](/glossary#edr)) bypass functionality. The observed campaigns highlight a concerning trend: the incorporation of [AI](/glossary#ai)-assisted code generation in offensive [malware](/glossary#malware) development, particularly in parts of SPECTRE and its associated Linux [rootkit](/glossary#rootkit), as detailed by [Cisco Talos](https://blog.talosintelligence.com/uat-10147-deploys-spectre-a-cross-platform-implant-with-linux-rootkit-and-byovd-capabilities/).

This activity represents a significant evolution in commodity intrusion tooling, blending SEO fraud monetization with advanced [persistence](/glossary#persistence) and [defense evasion](/glossary#defense-evasion). Security professionals should be acutely aware of UAT-10147's methods and the specific technical capabilities of SPECTRE to fortify their defenses.

## UAT-10147's Modus Operandi and Tooling

UAT-10147 demonstrates operational maturity through a diverse arsenal of tools, which includes custom malware, open-source offensive tooling, and sophisticated in-memory web shell deployment techniques. The actor has operationalized AI-assisted exploitation workflows to compromise internet-facing IIS and Linux servers at scale. Beyond the custom-developed SPECTRE backdoor, their toolkit features SEO fraud utilities and local [privilege escalation](/glossary#privilege-escalation) tools.

Analysis suggests a medium confidence association with an individual or group known as “xshen,” based on multiple development artifacts embedded in the BadIIS malware and related tooling observed in these campaigns. PDB paths referencing “xshen” were found in samples of BadIIS and its installer, pointing to a consistent developer or team behind some of the components.

### Targeting Internet-Facing Systems

The primary targets for UAT-10147 are internet-facing IIS and Linux servers. The actor focuses on gaining [initial access](/glossary#initial-access) and then deploying their sophisticated post-exploitation framework. This includes the use of in-memory web shells for covert authentication, blending control traffic into routine HTTP communications through custom HTTP headers like “X-ID.” Understanding these **UAT-10147 EDR bypass techniques** and server-side compromise methods is essential for effective defense.

## Deep Dive into SPECTRE: A Cross-Platform Backdoor

SPECTRE is a multi-platform backdoor written in C, notable for its custom post-exploitation and defense evasion capabilities compiled directly into its binaries. Talos named it based on a debug log recovered from a sample, which explicitly displayed the name in its header. Both Windows and Linux variants of SPECTRE have been observed, indicating the actor's intent to maintain a broad target base.

### Anti-Analysis and EDR Evasion

The Windows variant of SPECTRE prioritizes [obfuscation](/glossary#obfuscation) and anti-analysis through a dual-layered defense strategy:

*   **Runtime [API](/glossary#api) Resolution**: API resolution is executed entirely at runtime using PEB hash walking with a DJB2 variant algorithm. This makes static analysis challenging.
*   **String [Encryption](/glossary#encryption)**: Sensitive literals are encrypted at compile time with unique 32-bit seeds. They are decrypted to thread local storage immediately before execution and are never stored in plaintext within executable sections. This technique largely renders static detection methods ineffective.

Furthermore, SPECTRE includes an anti-analysis scoring routine. This routine evaluates factors such as process name blocklists, RAM capacity, CPU core count, disk space, sleep acceleration detection, and common [sandbox](/glossary#sandbox) hostnames or usernames. If a cumulative score reaches or exceeds 50 points, the process self-terminates, hindering analysis in sandbox environments. A key capability, particularly for Linux systems, is the deployment of kernel rootkits, and for Windows, Bring Your Own Virtual Driver (BYOVD) based EDR neutralization, allowing SPECTRE to operate with a high degree of stealth.

### Command and Control (C2)

SPECTRE utilizes HTTP POST requests for all C2 communications, transmitting data to `/api/v1/register` and `/api/v1/output` endpoints. A fallback C2 domain is hardcoded within the binary, recoverable through string decryption. Some implant versions also read their C2 configuration from an NTFS Alternate Data Stream (ADS) located at `C:\Windows\System32\drivers\etc\hosts:cache`, enabling easy updates to the C2 configuration without modifying the primary executable.

## Actionable Recommendations and Mitigations

Defending against threats like UAT-10147 and the SPECTRE implant requires a multi-faceted approach, focusing on preventive controls and detection capabilities. 

*   **[Patch](/glossary#patch) Management**: Ensure all internet-facing IIS and Linux servers are regularly patched and updated to the latest stable versions. This is critical to prevent exploitation of known vulnerabilities.
*   **Endpoint Detection and Response (EDR)**: Implement and configure effective EDR solutions on all endpoints and servers. Focus on behavioral detection to identify unusual process activity, unauthorized kernel module loading (for Linux systems), and attempts at EDR bypass. Regularly review EDR alerts and investigate suspicious activity promptly.
*   **[Network Segmentation](/glossary#network-segmentation)**: Segment networks to limit the [lateral movement](/glossary#lateral-movement) of threat actors should a compromise occur. Isolate critical servers and sensitive data.
*   **Monitor for Compromise**: Look for indicators of compromise (IOCs) such as unexpected HTTP POST requests to `/api/v1/register` or `/api/v1/output` from internal systems, or the presence of suspicious files in NTFS Alternate Data Streams (e.g., `C:\Windows\System32\drivers\etc\hosts:cache`).
*   **Regular Audits and [Hardening](/glossary#hardening)**: Conduct regular security audits of server configurations and apply hardening best practices. Review web server logs for suspicious activity, particularly concerning web shell deployment or unusual HTTP headers like “X-ID.”
*   **[Threat Hunting](/glossary#threat-hunting)**: Proactively hunt for signs of the **detect SPECTRE malware infection** by searching for unusual binaries, kernel module installations, and process injection attempts. Focus on processes interacting with critical system files or performing API calls indicative of evasion.

By prioritizing these measures, organizations can significantly reduce their [attack surface](/glossary#attack-surface) and improve their ability to detect and respond to advanced threats like those posed by UAT-10147.

**Related:** [Silent Swap Crypto Clipper: Fake Google Notes Ext Steals Wallets](/blog/silent-swap-crypto-clipper-fake-google-notes-ext-steals-wallets), [OkoBot Framework: Multi-Payload Data & Crypto Theft Attacks](/blog/okobot-framework-multi-payload-data-crypto-theft-attacks)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/spectre-malware-uat-10147-targets-iis-linux-servers-with-rootkits