UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

UAT-10147 operates a multi-platform post-exploitation ecosystem targeting IIS and Linux servers, deploying the SPECTRE implant, a cross-platform backdoor written in C. SPECTRE features include cross-platform C2 communications, process injection, credential theft, anti-analysis protections, and kernel-level EDR bypass using BYOVD drivers. The Windows version employs runtime API resolution via PEB hash walking and per-string xorshift32 encryption to evade detection. It supports 45 commands covering shell execution, file operations, process and token manipulation, keylogging, credential dumping, and EDR neutralization. The Linux variant includes a kernel rootkit with indications of AI-assisted code generation. The actor leverages SEO fraud tools and in-memory web shells with covert authentication headers. The campaign shows operational maturity and gradual adoption of AI-assisted malware development. No vendor advisory or patch information is provided.

The SPECTRE implant enables extensive post-exploitation capabilities including stealthy persistence, credential theft, process and token manipulation, EDR bypass, and covert command and control. This allows the threat actor to maintain long-term access, evade detection, and conduct unauthorized operations on compromised IIS and Linux servers. The use of kernel rootkits and BYOVD drivers increases the difficulty of detection and removal. The actor’s integration of AI-assisted development may accelerate the evolution and sophistication of their tools.

No official patch or remediation guidance is provided in the available data. Organizations should monitor vendor advisories for updates. Given the advanced evasion techniques and kernel-level components, detection and removal may require specialized endpoint security solutions capable of identifying BYOVD drivers and kernel rootkits. Incident response should focus on identifying indicators of compromise and isolating affected systems. No indication that the threat is mitigated or neutralized by existing controls is stated.