A Chinese-speaking cybercrime group is using AI-driven tools to help compromise internet-facing Windows and Linux web servers, according to Cisco Talos, Cisco’s threat intelligence research unit. Talos said the activity points to increasingly automated offensive operations.
Talos, which tracks the group as UAT-10147, found evidence that AI-generated operational guidance had been used during an intrusion. Researchers also recovered tooling that helped the attackers refine exploits when problems arose and automate parts of their activity after gaining access.
The campaign relied heavily on publicly disclosed vulnerabilities, Talos said. The use of AI could nevertheless allow attackers to carry out complex operations more efficiently while requiring less specialist expertise.
