Chinese Hackers Use AI Agents to Exploit Web Servers and Automate Attacks

A Chinese-speaking cybercrime group is using AI-assisted tools to turn vulnerable web servers into entry points. It shows how familiar flaws become more dangerous when attackers automate the work around them.

The group, tracked as UAT-10147, targeted internet-facing Windows and Linux systems in government, education, media, technology, and gaming. Victims were identified across several countries, while a linked server held a target list of about 170,000 URLs.

Cisco Talos identified the activity and found that the operators mixed public exploits with AI-generated instructions, scripts, and testing steps.

Cisco Talos said in a report shared with Cyber Security News (CSN) that the approach helped the group carry out complex intrusions at greater scale. The immediate concern is not a new flaw alone, but a faster attack process.

AI can help an operator scan a site, adjust a failed exploit, check whether a payload worked, gather system details, and set up a backdoor with far less manual effort. The activity signals a practical shift in criminal operations today.

Chinese Hackers Use AI Agents

UAT-10147 appears to use agent-like AI as an operational assistant rather than a single automated tool. Talos found generated playbooks, troubleshooting logic, exploit scripts, and validation workflows that supported activity before and after a server was compromised.

The group combined these workflows with established offensive frameworks. That blend allowed it to find weaknesses, build payloads, test results, and document the next action, reflecting wider concerns around AI agent security risks.

Initial access relied on publicly known remote-code-execution weaknesses. The campaign included Zimbra, AjaxPro, Nacos, and Telerik flaws, a reminder that web server RCE flaws can create a direct path to takeover.

On Windows, the operators used remote access to install BadIIS, a malicious IIS module associated with search-result manipulation. They also used scripts to raise privileges, weaken endpoint scanning around IIS folders, create high-privilege access, and retain control after the original break-in.

Linux targets followed a similar pattern. After placing a web shell, the group used local privilege-escalation bugs, including Dirty Pipe, to reach root access and install additional implants.

Automation Extends the Damage

The recovered material suggests the AI was involved across the full attack cycle, not merely in writing code. One guide produced a structured route for abusing ASP.NET ViewState deserialization, from checking stolen configuration keys to creating payloads and confirming execution without obvious visible effects.

The scripts checked writable folders, mapped IIS sites, deployed an implant, placed a web shell, and collected results through callbacks. A failed attack need not stop the operator: the workflow can diagnose an obstacle and try an alternative.

Talos also observed the group use a cloud configuration service to collect basic victim details after exploiting Nacos. By blending stolen information with routine-looking web traffic, attackers may make initial confirmation and follow-up activity harder for defenders to spot.

Organizations should treat public-facing web servers as high-priority assets. Rapid patching, limiting unnecessary exposure, reviewing IIS and application configuration changes, and watching for unusual scheduled tasks, new accounts, outbound connections, and excluded security paths can interrupt this kind of chain.

Teams should also protect ASP.NET MachineKey material and investigate unexpected server errors rather than dismissing them as noise.

In particular, error responses can reveal whether an attacker is testing deserialization access, while IIS deployment vulnerability risks show why tightly restricting administrative endpoints matters.

The campaign does not mean AI has made attacks fully independent of people. It does show that financially motivated groups can use it to repeat established techniques more efficiently, reducing the time between finding a weakness and turning it into a profitable intrusion.

For defenders, the practical lesson is straightforward: reduce the attack surface before automated tooling reaches it.

Maintaining inventories, applying security updates, protecting secrets, and monitoring web-server behavior remain essential, particularly amid reporting on an actively exploited Magento weakness that similarly turns exposed application flaws into takeover opportunities.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC