Among the files Cisco Talos pulled off a criminal group's command server was a step-by-step guide to attacking Microsoft web servers. It listed the prerequisites, gave a quiet way to test whether a stolen key still worked, supplied a script to automate delivery, and recorded what the operators had already tried that did not work. It was written by an AI, for the attackers, and they had followed it.
Talos published research on August 20, by Joey Chen, on a Chinese-speaking cybercrime group it tracks as UAT-10147. The group breaks into internet-facing Windows and Linux web servers using publicly known vulnerabilities, then makes money through search engine manipulation and data theft. Talos assesses with moderate-to-high confidence that the crew belongs to an emerging class of financially motivated operators using AI to run offensive work at scale, rather than just to help write scripts.
A guide that documents its own mistakes
The guide covers ASP.NET ViewState attacks, which let an attacker run commands on a web server if they hold its secret signing keys. It opens with what the attacker needs, including that key material, and notes it is usually pulled from a public database of leaked ASP.NET key configurations. Talos draws the defensive conclusion: the technique depends entirely on key exposure, which makes keeping those keys secret the single most important control.
What follows reads like a competent tester's notes. It gives a low-noise way to check whether a stolen key is valid, by sending a deliberately broken payload and reading which of two server errors comes back. It corrects a claim in public write-ups that .NET 4.8 had fixed a particular payload gadget; it had not. It warns that a successful attack shows up as an HTTP 500 error, which Talos flags as a blind spot for teams whose monitoring treats 500s as noise. And it records a lesson learned the hard way: making the server pause to prove code ran does not work here, because the command launches asynchronously and returns immediately.
Where the AI stops and the old tools take over
The crew also runs PentestGPT on its command server to scan targets and fire proof-of-concept exploits, and keeps a code scanner called DeepAudit on a management machine, though Talos saw no victim compromised through it.
Everything after the break-in is conventional. Initial access comes from known one-day flaws including CVE-2022-27925 in Zimbra Collaboration Suite, CVE-2021-23758 in AjaxPro, CVE-2021-29441 in Nacos and CVE-2019-18935 in Telerik UI for ASP.NET AJAX. On Windows the crew escalates with EfsPotato, adds the IIS directories to Defender's exclusion list so its malicious server modules land unscanned, and installs QuasarRAT disguised as svchosts.exe. On Linux it drops a web shell and picks from a shelf of privilege escalation exploits. In a companion report, Talos details SPECTRE, a cross-platform implant the same crew deploys carrying a Linux rootkit and driver-based detection bypass.
An open directory gave it away
Talos found the campaign because a compromised machine was talking to a download server at 139[.]180[.]197[.]150 that had directory listing switched on. Inside sat a target list of roughly 170,000 URLs. Confirmed victims are in Brazil, Bolivia, China, Canada and Vietnam, across government, education, media and gaming.
IntelFusions previously reported on attackers planting BadIIS on a hijacked server, the same search-fraud malware this crew deploys, and on an operator who ran a fleet of AI agents to backdoor 9,000 sites. The pattern is not that AI invented a new attack. It is that the tedious parts of an intrusion, the writing up, the testing, the troubleshooting, are being handed off, which lowers the skill needed to run the rest.
Patch the flaws above, keep ASP.NET machine keys out of source control, and treat a sudden Defender exclusion on an IIS directory as an incident. Talos' full report carries the indicators.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.