AI Is Accelerating Attacks on Exposed Web Servers: Inside UAT-10147 and What Hosting Operators Should Do About It
A financially motivated, Chinese-speaking cybercrime group is using AI-driven tools to compromise internet-facing Windows and Linux web servers — and Cisco Talos, Cisco's threat intelligence unit, says the tradecraft points to increasingly automated offensive operations. The group, tracked as UAT-10147 , leaned heavily on well-known, publicly disclosed vulnerabilities, yet researchers recovered evidence that AI-generated operational guidance was used mid-intrusion and that tooling helped attackers repair failing exploits on the fly. On the group's command-and-control infrastructure, Talos even found a target list of roughly 170,000 URLs. For anyone running a VPS, dedicated box, or hosted WordPress site, the takeaway is uncomfortable but clear: you do not need to be a high-profile brand to land on an attacker's worklist. Related ServerSpan guide: A Practical Guide to VPS Hardening: 15 Essential Security Steps for Linux Servers . What Talos Found Inside the UAT-10147 Camp...