UAT-10147 Turns Public Exploits Into Repeatable Ops
Cisco Talos says UAT-10147, a Chinese-speaking cybercrime group, is using AI-generated playbooks and open-source offensive tools to run intrusions against Windows and Linux web servers across government, education, media, technology, and gaming targets. Talos also found a target list of about 170,000 URLs, split into smaller batches for scanning.
The group used AI to draft exploit steps, validate whether a payload or persistence trick worked, and adjust when it failed, alongside tools such as Metasploit, ysoserial, PentestGPT, and DeepAudit. That turns public vulnerabilities into repeatable intrusion routines, so the same attack chain can be tested, tuned, and reused with less operator skill.
For teams with internet-facing web apps, the exposure is not just the CVEs themselves but how quickly they can be operationalized across many hosts. Talos says this looks like a shift from AI-assisted scripting to semi-autonomous offensive orchestration, which raises the tempo of repeated intrusion attempts and broadens who can run them.