Signalis
sign in--:--:--UTC
Threat actors

UAT-10147

☆ pin
Reports
6
First seen
Aug 20, 2026
Last seen
Sep 8, 2026
Motivation
Financial, Espionage

Relationships

CVE-2015-3246, in 4 of UAT-10147's reports, exploited in the wild×4CVE-2015-3246CVE-2015-5287, in 4 of UAT-10147's reports, exploited in the wild×4CVE-2015-5287CVE-2021-23758, in 4 of UAT-10147's reports, exploited in the wild×4CVE-2021-23758CVE-2022-0995, in 4 of UAT-10147's reports, exploited in the wild×4CVE-2022-0995Co-mentioned with UAT-10147 in 1 Signalis report (co-mention, not confirmed collaboration)×1xshenCo-mentioned with UAT-10147 in 1 Signalis report (co-mention, not confirmed collaboration)×1chinesespea…Reports targeting TechnologyTechnologyReports targeting OtherOtherUAT-10147

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors
Technology ×1Other ×1

Top ATT&CK techniques

T1505.003 Web Shell ×5T1562.001 Impair Defenses: Disable or Modify Tools ×5T1190 Exploit Public-Facing Application ×4T1068 Exploitation for Privilege Escalation ×4T1059.001 PowerShell ×2T1041 Exfiltration Over C2 Channel ×2T1027 Obfuscated Files or Information ×2T1218 System Binary Proxy Execution ×2T1547 Boot or Logon Autostart Execution ×2T1083 File and Directory Discovery ×2T1059 Command and Scripting Interpreter ×2T1047 Windows Management Instrumentation ×2

Indicators

cve ×56filename ×20domain ×12hash_sha256 ×5hash_md5 ×5registry_key ×4ip_v4 ×2url ×2

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2021-23758 (exploited)CVE-2015-3246 (exploited)CVE-2022-0995 (exploited)CVE-2015-5287 (exploited)CVE-2021-3156 (exploited)CVE-2022-0847 (exploited)CVE-2022-27925 (exploited)CVE-2010-3904 (exploited)CVE-2019-18935 (exploited)CVE-2021-29441 (exploited)CVE-2021-29442 (exploited)CVE-2021-21551 (exploited)CVE-2019-16098 (exploited)CVE-2026-72898 (exploited)CVE-2026-8452 (exploited)CVE-2026-9198 (exploited)CVE-2019-1068CVE-2025-62593 (exploited)CVE-2025-68613 (exploited)CVE-2026-0300

Recent reports

High

August 2026 CVE Landscape: 73 High-Impact Vulnerabilities and AI-Assisted Exploitation Trends

Recorded Future InsiktHigh

CISA Adds Six Exploited Flaws to KEV Catalog, Including NetScaler, Linux, SQL Server Bugs

The Hacker NewsHigh

UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

The Hacker NewsHigh

Threat Source: UAT-10147 Chinese cybercrime group leverages agentic AI and SPECTRE implant

Cisco TalosHigh

UAT-10147 deploys SPECTRE: Cross-platform implant with Linux rootkit and BYOVD capabilities

Cisco TalosHigh

UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations

Cisco Talos

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans