Executive Summary

Cisco Talos identified the Chinese-speaking cybercrime group UAT-10147, which targets vulnerable web servers worldwide. The report outlines the campaign’s scope, affected countries, the role of BadIIS infections, the attack chain, and post‑compromise tactics, highlighting the integration of agentic AI to enhance operations.

---

Intelligence Metadata - Source Publisher: Cisco Talos - Published Date: 2026-08-20T10:00:32+00:00 - Category: research

Original Description: Cisco Talos discovered a Chinese-speaking cybercrime group, tracked as UAT-10147, that targets a wide range of vulnerable web servers. This is an overview of the campaign, examining the countries affected, potential impact of BadIIS infections, the attack chain, and post-compromise tactics.

"The industrial landscape is already littered with remains of once successful companies that could not adapt their strategic vision to altered conditions of competition."

— Abernathy