UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud
Essential information
- Published
- 02/10/2025 15:07
- Modified
- 02/10/2025 16:18
- Tags
- 2025-10-02 badiis chinese-speaking cobalt strike cybercrime data theft iis servers seo fraud web shells
- Related entities
- 80 observables, 1 intrusion sets (apt), 10 techniques (mitre), 8 others
Description
A Chinese-speaking cybercrime group, UAT-8099, is targeting high-value Internet Information Services (IIS) servers for search engine optimization fraud and data theft. The group focuses on reputable servers in India, Thailand, Vietnam, Canada, and Brazil, affecting universities, tech firms, and telecom providers. UAT-8099 uses web shells, hacking tools, Cobalt Strike, and BadIIS malware to manipulate search rankings and maintain persistence. They exploit weak file upload settings, enable guest accounts, and use RDP for access. The group also steals valuable credentials, configuration files, and certificates. New BadIIS variants with low detection rates and Chinese debug strings have been identified. The attackers employ SEO techniques like backlinking and inject malicious JavaScript to redirect users to fraudulent websites.