Loading malware…
SPECTRE is a custom backdoor written in C with separate Windows and Linux variants, used by the Chinese-speaking, financially motivated threat actor UAT-10147 since at least April 2026. It is deployed during post-exploitation of internet-facing web servers, including IIS servers, following exploitation of publicly disclosed vulnerabilities. Associated intrusions have affected government, education, media, technology, and gaming organizations, with compromised servers observed in Brazil, Bolivia, China, Canada, and Vietnam.
The Windows variant extends the Havoc framework and supports 45 commands covering reconnaissance, file transfer and manipulation, shell execution, screenshots, keylogging, credential theft, process injection, privilege escalation, and in-memory .NET assembly execution. Its injection techniques include process hollowing, Early Bird APC injection, and self-hollowing. It can obtain SYSTEM privileges through named-pipe impersonation, collect registry hives for offline credential extraction, enumerate Windows Credential Manager entries, and collect Chrome and Edge login data. Its bring-your-own-vulnerable-driver functionality abuses drivers affected by CVE-2019-16098 and CVE-2021-21551 to remove kernel notification callbacks and impair callback-dependent EDR visibility for the remainder of the session.
SPECTRE communicates with command-and-control infrastructure using HTTP POST requests. Windows evasion features include runtime API resolution, encrypted strings, weighted anti-analysis checks, and configuration storage in an NTFS alternate data stream. The Linux variant is a statically linked x86-64 ELF implant supporting 29 commands, anti-sandbox checks, and timestamp manipulation. It can deploy and control the separate Specter Linux kernel rootkit, which provides process and module hiding, root privilege escalation, and reboot persistence through a fraudulent systemd service. Specter uses the Linux ftrace framework to redirect kernel handlers.
13 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 more CVE associated with this family tracked in Mallory.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
AI-generated scripts were used to validate ASP.NET ViewState RCE, identify writable directories, deploy the SPECTRE implant and web shells...
51 distinct techniques documented for this family, organized by ATT&CK tactic.
T1588.002 — Obtain Capabilities: Tool (Resource Development)
T1608 — Stage Capabilities (Resource Development)
UAT-10147 is a Chinese-speaking intrusion actor targeting IIS and Linux servers with a sophisticated post-exploitation toolkit
Persistance via tâche planifiée nommée Google Chrome Start
In one case, the threat actor is said to have successfully exploited a website and collected information about the victim host using Linux commands.
T1059.001 — Command and Scripting Interpreter: PowerShell (Execution)
T1059.004 — Command and Scripting Interpreter: Unix Shell (Execution)
Persistance via tâche planifiée nommée Google Chrome Start
Select instances entail the deployment of a web shell, which then paves the way for BadIIS and additional backdoors for persistent access.
To maintain persistence, it utilizes a fraudulent systemd unit file named “hardware-monitor.service”
To maintain persistence, it utilizes a fraudulent systemd unit file named “hardware-monitor.service” ... configured with “Before=sysinit.target”
This architecture grants the threat actor persistent, kernel-level control of the compromised host that survives both reboots and most user-level security controls
Persistance via tâche planifiée nommée Google Chrome Start
The researchers noted that SPECTRE represents a significant evolution in commodity intrusion tooling, integrating cross-platform command-and-control (C2) operations, process injection, credentiasl theft, anti-analysis protections, and kernel-level endpoint detection and response (EDR) bypass functionality.
T1055.001 — Process Injection: Dynamic-link Library Injection (Defense Evasion)
45 commandes dont : injection de processus (hollowing, APC EarlyBird, self-hollowing sur RuntimeBroker.exe)
The Windows version is equipped to perform file operations ... inject shellcode, use process hollowing and Early Bird APC injection
The Linux attacks, like in the case, leverage various known vulnerabilities to obtain an initial foothold, followed by abusing various known Local Privilege Escalation (LPE) exploits to escalate to root | The BYOVD attack utilizes two well-known vulnerable drivers MSI's "RTCore64.sys" (CVE-2019-16098) and Dell's "DBUtil_2_3.sys" (CVE-2021-21551) to obtain elevated privileges and terminate security-related processes.
The SPECTRE implements named pipe impersonation for privilege escalation... acquires a SYSTEM token via ImpersonateNamedPipeClient.
élévation de privilèges (named pipe impersonation → token SYSTEM)
To maintain persistence, it utilizes a fraudulent systemd unit file named “hardware-monitor.service”
To maintain persistence, it utilizes a fraudulent systemd unit file named “hardware-monitor.service” ... configured with “Before=sysinit.target”
This architecture grants the threat actor persistent, kernel-level control of the compromised host that survives both reboots and most user-level security controls
Using EfsPotato to gain elevated system privileges, configure Microsoft Defender exclusions
while the actor also uses Linux kernel rootkits
SPECTRE, per Talos, is a cross-platform backdoor written in C that features obfuscation and anti-analysis techniques to fly under the radar.
API resolution is executed entirely at runtime via PEB hash walking, using a DJB2 variant algorithm.
The researchers noted that SPECTRE represents a significant evolution in commodity intrusion tooling, integrating cross-platform command-and-control (C2) operations, process injection, credentiasl theft, anti-analysis protections, and kernel-level endpoint detection and response (EDR) bypass functionality.
T1055.001 — Process Injection: Dynamic-link Library Injection (Defense Evasion)
45 commandes dont : injection de processus (hollowing, APC EarlyBird, self-hollowing sur RuntimeBroker.exe)
The Windows version is equipped to perform file operations ... inject shellcode, use process hollowing and Early Bird APC injection
Deleting initial payloads to cover its tracks and thwart forensic analysis
A particularly notable feature is the timestomp command, an anti-forensics mechanism that utilizes the utimensat() function and operator-provided timestamps to alter a file's modification, access, and change times.
The SPECTRE implements named pipe impersonation for privilege escalation... acquires a SYSTEM token via ImpersonateNamedPipeClient.
élévation de privilèges (named pipe impersonation → token SYSTEM)
Both versions employ a weighted scoring mechanism that causes the program to self-terminate if the score exceeds 50 points. The evaluation is based on process name blocklists, RAM capacity, CPU core count, disk space, sleep acceleration detection, and common sandbox host names and usernames.
evaluates process name blocklists, RAM capacity, CPU core count, disk space, sleep acceleration detection, and common sandbox host names and usernames
configuration C2 lisible depuis un NTFS Alternate Data Stream (C:\Windows\System32\drivers\etc\hosts:cache)
T1620 — Reflective Code Loading (Defense Evasion)
UAT-10147 demonstrated operational maturity through the combined use of custom malware, open-source offensive tooling, bring your own virtual driver (BYOVD)-based EDR neutralization, Linux kernel rootkits
The researchers noted that SPECTRE represents a significant evolution in commodity intrusion tooling, integrating cross-platform command-and-control (C2) operations, process injection, credentiasl theft, anti-analysis protections, and kernel-level endpoint detection and response (EDR) bypass functionality.
vol de credentials (SAM/SYSTEM/SECURITY hive dump, Chromedump, Vaultdump)
T1003.005 — OS Credential Dumping: Cached Domain Credentials (Credential Access)
The Windows version is equipped to perform file operations, record keystrokes, take screenshots
T1056.001 — Input Capture: Keylogging (Collection)
T1539 — Steal Web Session Cookie (Credential Access)
Vaultdump: Spawns cmdkey.exe /list with stdout capture to enumerate Windows Credential Manager entries
Chromedump: Copies Chrome and Edge login data and local state files to “%TEMP%” for offline DPAPI decryption
Network interface information
Print UID/GID/groups
The Windows version is equipped to perform file operations, record keystrokes, take screenshots, download/upload files, execute shell commands, get running processes
Conducting systematic reconnaissance following code execution via PowerShell to collect system information, privilege tokens, web directory listings, IIS site configurations, network interface data, and running processes
Webroot enumeration: dir C:\inetpub\wwwroot\ -Name reveals deployed applications
the timestomp command... alter a file's modification, access, and change times
Both versions employ a weighted scoring mechanism that causes the program to self-terminate if the score exceeds 50 points. The evaluation is based on process name blocklists, RAM capacity, CPU core count, disk space, sleep acceleration detection, and common sandbox host names and usernames.
evaluates process name blocklists, RAM capacity, CPU core count, disk space, sleep acceleration detection, and common sandbox host names and usernames
The Windows version is equipped to perform file operations, record keystrokes, take screenshots
T1056.001 — Input Capture: Keylogging (Collection)
The Windows version is equipped to perform file operations, record keystrokes, take screenshots
The researchers noted that SPECTRE represents a significant evolution in commodity intrusion tooling, integrating cross-platform command-and-control (C2) operations
T1071.001 — Application Layer Protocol: Web Protocols (Command and Control)
T1102 — Web Service (Command and Control)
Using a batch script that employs certutil to download a privilege escalation tool ("EfsPotato"), a secondary batch script, and Quasar RAT from a remote server
T1573 — Encrypted Channel (Command and Control)
T1041 — Exfiltration Over C2 Channel (Exfiltration)
By routing exfiltrated data to a legitimate cloud-based configuration management service, the attackers effectively blend their traffic with normal administrative operations
64 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.