cvekit
LIVE
Threat actors

UAT-10147

crimewareCNvia MISP

4 CVEs attributed
UAT-10147 is a Chinese-speaking, financially motivated threat actor targeting internet-facing Windows and Linux servers through the exploitation of publicly disclosed vulnerabilities. The group employs advanced techniques including AI-assisted workflows, deploying malware such as SPECTRE and various RATs, and utilizing capabilities like remote code execution and privilege escalation. Their operations are characterized by the integration of AI for reconnaissance, exploit refinement, and persistent access management. UAT-10147 has a target list of approximately 170,000 URLs and impacts various sectors, including government and education.

Attributed CVEs4

CVEDescriptionSeverityEPSSFlagsModified
CVE-2021-23758

All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.

CRITICAL9.8
83%p100
KEVWeaponized
2026-08-27
CVE-2022-0995

An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system.

HIGH7.8
8.86%p95
KEVWeaponized
2026-08-27
CVE-2015-3246

libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.

HIGH7.4
8.50%p95
KEVWeaponized
2026-10-02
CVE-2015-5287

The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.

HIGH7.8
5.00%p92
KEVWeaponized
2026-08-27