Threats & Adversaries

UAT-10147 Turns Public Exploits Into Repeatable Ops

Cisco Talos says UAT-10147, a Chinese-speaking cybercrime group, is using AI-generated playbooks and open-source offensive tools to run intrusions against Windows and Linux web servers across government, education, media, technology, and gaming targets. Talos also found a target list of about 170,000 URLs, split into smaller batches for scanning.

The group used AI to draft exploit steps, validate whether a payload or persistence trick worked, and adjust when it failed, alongside tools such as Metasploit, ysoserial, PentestGPT, and DeepAudit. That turns public vulnerabilities into repeatable intrusion routines, so the same attack chain can be tested, tuned, and reused with less operator skill.

For teams with internet-facing web apps, the exposure is not just the CVEs themselves but how quickly they can be operationalized across many hosts. Talos says this looks like a shift from AI-assisted scripting to semi-autonomous offensive orchestration, which raises the tempo of repeated intrusion attempts and broadens who can run them.

1 source · Aug 20

CVE-2021-3156

NVD KEV

Known exploited · CISA KEV

CVSS 7.8 HIGH: sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows… EPSS 100% (100th percentile).

CISA federal remediation date Apr 27 · date passed

CVE-2022-0847

NVD KEV

Known exploited · CISA KEV

CVSS 7.8 HIGH: a flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in… EPSS 93% (100th percentile).

CISA federal remediation date May 16 · date passed

Timeline

Sources

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-08-21

Every edition of this story: UAT-10147 Turns Public Exploits Into Repeatable Ops

More from today