aviatrix logoAviatrix
Under Active Attack

Executive Summary

In August 2026, Recorded Future's Insikt Group identified 73 high-impact vulnerabilities actively exploited in the wild, marking a significant shift in threat actor operations with the emergence of AI-assisted exploitation campaigns. The Chinese-speaking threat group UAT-10147 demonstrated a novel approach by combining traditional vulnerability exploitation with agentic artificial intelligence tools like DeepAudit and PentestGPT for post-compromise operations. The group systematically targeted internet-facing servers through vulnerabilities in Zimbra, AjaxPro, Nacos, and Telerik platforms before deploying AI agents for automated privilege escalation and lateral movement across compromised networks.

This incident represents a critical evolution in cyber warfare, as threat actors increasingly integrate AI capabilities into their attack workflows to scale operations and enhance target selection. The convergence of AI-powered offensive tools with traditional exploitation techniques signals a new era of automated cyber threats that can operate with unprecedented speed and precision, fundamentally changing the threat landscape for enterprise security teams.

Why This Matters Now

The integration of AI agents into active cyber campaigns marks a paradigm shift where attackers can automate complex post-exploitation activities, dramatically increasing the scale and speed of network compromise while reducing the technical expertise required for sophisticated attacks.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

UAT-10147 deployed agentic AI tools including DeepAudit and PentestGPT for automated post-compromise operations, enabling scalable privilege escalation and lateral movement across compromised networks.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF segmentation and workload isolation would likely have constrained UAT-10147's lateral movement between compromised web servers and reduced the overall blast radius of their multi-platform exploitation campaign.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Workload isolation policies would likely have limited the scope of initial server compromise and reduced the attack surface available for multi-platform vulnerability exploitation across web infrastructure.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Identity-aware access controls would likely have constrained the scope of privilege escalation attempts and limited the blast radius of kernel-level exploits across segmented workload boundaries.

Lateral Movement

Control: East-West Traffic Security

Mitigation: Microsegmentation and east-west traffic controls would likely have constrained lateral movement pathways between web servers and internal systems, reducing the attacker's ability to pivot across network segments.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Enhanced visibility controls would likely have detected anomalous communication patterns and AI tool deployment activities, potentially constraining the establishment of persistent command channels across compromised infrastructure.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress policy controls would likely have constrained unauthorized data transmission pathways and limited the volume of sensitive information that automated exfiltration tools could successfully transfer from compromised environments.

Impact (Mitigations)

While some web server compromise may persist, the overall impact scope would likely be reduced through containment of lateral spread and limitation of cross-system access privileges.

Impact at a Glance

Affected Business Functions

  • Cybersecurity Operations
  • Vulnerability Management
  • Threat Intelligence Analysis
  • Enterprise Security Monitoring
Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: N/A

Data Exposure

Comprehensive vulnerability intelligence data including 73 high-impact vulnerabilities, exploit methodologies, and threat actor techniques. Exposure of security research findings, Nuclei detection templates, and AI-assisted attack workflows used by APT groups.

Recommended Actions

  • • Implement Zero Trust Segmentation to prevent lateral movement between compromised web servers and internal systems
  • • Deploy Egress Security & Policy Enforcement to detect and block AI-assisted data exfiltration attempts
  • • Enable East-West Traffic Security monitoring to identify suspicious inter-system communications during lateral movement
  • • Utilize Inline IPS (Suricata) to detect and block exploitation of known CVEs like Telerik, AjaxPro, and Zimbra vulnerabilities
  • • Establish Multicloud Visibility & Control to monitor for anomalous automation patterns and AI-assisted attack tools

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image