An adversary that writes its own playbooks

Cisco Talos has published an analysis of UAT-10147, a Chinese-speaking cybercrime group it identified in early 2026. The group targets vulnerable web servers for SEO fraud and data theft across government, education, media, technology and gaming, with a target list of roughly 170,000 URLs across Brazil, Bolivia, China, Canada and Vietnam.

Where the AI sits

The detail that separates this from the usual reporting is placement. The AI is not writing phishing lures or generating malware ahead of the intrusion — it is working after access, on exploit refinement, adaptive troubleshooting, post-exploitation automation with validation steps, and generating operational documentation of real intrusions.

Talos names PentestGPT and DeepAudit as the tools, used to scan targets dynamically and produce exploitation guides complete with prerequisite checklists, payload validation techniques and reconnaissance playbooks.

The conventional tooling around it is unremarkable: Metasploit and ysoserial for exploitation, QuasarRAT, NoodleRAT, SPECTRE and Gh0stCringe as implants, EfsPotato and CVE-2022-0995, CVE-2021-3156 and CVE-2022-0847 for privilege escalation. Nothing in that list is new.

Detection

• ClamAV: Py.Loader.Tool-10060293-1 and -2, Win.Malware.Generic-10060228-0, Win.Loader.Downloader-10060287-1.
• Snort: 1:66697 and 1:66696.
• Full indicators are published in the Cisco Talos IOC repository on GitHub.

What generalises here is the economics, not the technique. Documentation and validation are the parts of an intrusion that take a skilled operator's time and do not scale; automating them lets the same crew run more operations at once against the same old vulnerabilities.