UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

Chinese-speaking intrusion actor UAT-10147 is employing a sophisticated, cross-platform intrusion toolset, SPECTRE, leveraging AI-assisted development to evade detection. SPECTRE is a cross-platform backdoor with Linux rootkit capabilities (Specter) designed to neutralize EDR systems and maintain persistent control over compromised hosts. The toolset combines SEO fraud monetization with advanced persistence and defense evasion techniques, utilizing custom malware, open-source offensive tooling, and Bring Your Own Virtual Driver (BYOVD) based EDR neutralization. Talos has identified evidence suggesting AI-assisted development was used in the creation of SPECTRE and Specter, highlighting the growing role of generative AI in offensive malware development.