SecuriTricks - chinese-speaking

UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud

A Chinese-speaking cybercrime group, UAT-8099, is targeting high-value Internet Information Services (IIS) servers for search engine optimization fraud and data theft. The group focuses on reputable servers in India, Thailand, Vietnam, Canada, and Brazil, affecting universities, tech firms, and tel…

data theft

cobalt strike

Published: October 2, 2025

Downloadable IOCs: 80

Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign

A Chinese-speaking threat actor group, tracked as CL-UNK-1037, has been conducting a large-scale SEO poisoning campaign called Operation Rewrite. The attackers use a malicious IIS module named BadIIS to intercept and alter web traffic on compromised servers, manipulating search engine results to re…

Published: September 25, 2025

Downloadable IOCs: 71

Technical Analysis of kkRAT

A malware campaign targeting Chinese-speaking users has been identified, delivering three types of malware: ValleyRAT, FatalRAT, and kkRAT. The campaign uses fake installer pages to distribute the malware. kkRAT, a new Remote Access Trojan, shares similarities with Ghost RAT and Big Bad Wolf. It em…

Published: September 10, 2025

Downloadable IOCs: 0

Malicious Signal, Line, and Gmail Installers Target Chinese-Speaking Users with Backdoors

A malicious campaign is targeting Chinese-speaking users by distributing backdoored executables through fake download pages for popular apps like Signal, Line, and Gmail. The attackers use seemingly unrelated domain names and rely on search engine manipulation to lure victims. The malware follows a…

backdoor

infostealer

search engine manipulation

Published: February 18, 2025

Downloadable IOCs: 0

Tag: chinese-speaking

Attack reports

UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud

Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign

Technical Analysis of kkRAT

Malicious Signal, Line, and Gmail Installers Target Chinese-Speaking Users with Backdoors