Threats · 54 days ago

UAT-10147 Turns Public Exploits Into Repeatable Ops

Cisco Talos says UAT-10147, a Chinese-speaking cybercrime group, is using AI-generated playbooks and open-source offensive tools to run intrusions against Windows and Linux web servers across government, education, media, technology, and gaming targets. Talos also found a target list of about 170,000 URLs, split into smaller batches for scanning.

The group used AI to draft exploit steps, validate whether a payload or persistence trick worked, and adjust when it failed, alongside tools such as Metasploit, ysoserial, PentestGPT, and DeepAudit. That turns public vulnerabilities into repeatable intrusion routines, so the same attack chain can be tested, tuned, and reused with less operator skill.

For teams with internet-facing web apps, the exposure is not just the CVEs themselves but how quickly they can be operationalized across many hosts. Talos says this looks like a shift from AI-assisted scripting to semi-autonomous offensive orchestration, which raises the tempo of repeated intrusion attempts and broadens who can run them.

CVE-2021-3156

NVD KEV

Known exploited · CISA KEV

CVSS 7.8 HIGH: sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows… EPSS 100% (100th percentile).

CISA federal remediation date Apr 27 · date passed

CVE-2022-0847

NVD KEV

Known exploited · CISA KEV

CVSS 7.8 HIGH: a flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in… EPSS 93% (100th percentile).

CISA federal remediation date May 16 · date passed

Timeline

Aug 20 Reported by Talos Intelligence
May 16 CISA federal deadline for CVE-2022-0847 passed
Apr 27 CISA federal deadline for CVE-2021-3156 passed
Apr 25 CVE-2022-0847 added to CISA KEV
Apr 6 CVE-2021-3156 added to CISA KEV

Sources

1 source covering this story

Talos Intelligence Aug 20
UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
Cisco Talos discovered a Chinese-speaking cybercrime group, tracked as UAT-10147, that targets a wide range of vulnerable web servers.

Entities

CVE-2021-3156
CVE-2022-0847
UAT-10147

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-08-21

Editions

Threats · 54 days agoUAT-10147 Turns Public Exploits Into Repeatable OpsCisco Talos says UAT-10147, a Chinese-speaking cybercrime group, is using AI-generated playbooks and open-source offensive tools to run intrusions against Windows and Linux web servers across government, education, media, technology, and gaming targets. Talos also found a target list of about 170,000 URLs, split into smaller batches for scanning.The group used AI to draft exploit steps, validate whether a payload or persistence trick worked, and adjust when it failed, alongside tools such as Metasploit, ysoserial, PentestGPT, and DeepAudit. That turns public vulnerabilities into repeatable intrusion routines, so the same attack chain can be tested, tuned, and reused with less operator skill.For teams with internet-facing web apps, the exposure is not just the CVEs themselves but how quickly they can be operationalized across many hosts. Talos says this looks like a shift from AI-assisted scripting to semi-autonomous offensive orchestration, which raises the tempo of repeated intrusion attempts and broadens who can run them.

CVE-2021-3156

NVD KEV

Known exploited · CISA KEV

CVSS 7.8 HIGH: sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows… EPSS 100% (100th percentile).

CISA federal remediation date Apr 27 · date passed

CVE-2022-0847

NVD KEV

Known exploited · CISA KEV

CVSS 7.8 HIGH: a flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in… EPSS 93% (100th percentile).