UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

UAT-10147 is a Chinese-speaking intrusion actor that compromises IIS and Linux servers and operates a multi-platform post-exploitation ecosystem. The newly identified SPECTRE implant combines cross-platform command-and-control, process injection, credential theft and anti-analysis capabilities. For persistence and defence suppression the actor uses Linux kernel rootkits and BYOVD, in which vulnerable, legitimately signed drivers are loaded to neutralise EDR sensors at kernel level. For privilege escalation the attacker uses Potato-family tools such as GodPotato, JuicyPotato, EfsPotato and RustPotato, some compiled from source by the actor itself; embedded PDB paths leaked details of the development environment. Part of the activity is monetised through search engine optimisation (SEO) fraud; no CVE IDs are referenced.