Tag: regional targeting

2 Attack Reports | 0 Vulnerabilities

Attack reports

Dissecting UAT-8099: New persistence mechanisms and regional focus

UAT-8099, a threat actor targeting vulnerable IIS servers across Asia, has launched a new campaign from late 2025 to early 2026. The group's tactics have evolved, focusing on Thailand and Vietnam, and employing web shells, PowerShell scripts, and the GotoHTTP tool for remote access. New variants of…
powershell
persistence
vietnam
iis
thailand
badiis
asia
web shells
seo fraud
regional targeting
2026-01-29
gotohttp
Published: January 29, 2026
Downloadable IOCs: 74

The Mystery OAST Host Behind a Regionally Focused Exploit Operation

A long-running, attacker-operated OAST service on Google Cloud has been observed driving a focused exploit operation. The actor combines stock Nuclei templates with custom payloads to expand their reach. All observed activity targeted canaries deployed in Brazil, indicating a deliberate regional fo…
exploit
brazil
google cloud
CVE-2025-4428
CVE-2025-2611
2025-11-28
oast
fastjson
regional targeting
nuclei
scanning infrastructure
Published: November 28, 2025
Linked vulnerabilities : CVE-2025-4428, CVE-2025-2611 (CVSS 9.3)
Downloadable IOCs: 6
Click here to see more Attack Reports