Tag: seo fraud

3 Attack Reports | 0 Vulnerabilities

Attack reports

Dissecting UAT-8099: New persistence mechanisms and regional focus

UAT-8099, a threat actor targeting vulnerable IIS servers across Asia, has launched a new campaign from late 2025 to early 2026. The group's tactics have evolved, focusing on Thailand and Vietnam, and employing web shells, PowerShell scripts, and the GotoHTTP tool for remote access. New variants of…
powershell
persistence
vietnam
iis
thailand
badiis
asia
web shells
seo fraud
regional targeting
2026-01-29
gotohttp
Published: January 29, 2026
Downloadable IOCs: 74

UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud

A Chinese-speaking cybercrime group, UAT-8099, is targeting high-value Internet Information Services (IIS) servers for search engine optimization fraud and data theft. The group focuses on reputable servers in India, Thailand, Vietnam, Canada, and Brazil, affecting universities, tech firms, and tel…
data theft
cobalt strike
cybercrime
badiis
chinese-speaking
web shells
seo fraud
2025-10-02
iis servers
Published: October 2, 2025
Downloadable IOCs: 80

GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes

ESET researchers have identified a new threat actor named GhostRedirector that has compromised at least 65 Windows servers, primarily in Brazil, Thailand, and Vietnam. The actor utilizes two previously undocumented tools: a passive C++ backdoor called Rungan and a malicious Internet Information Ser…
backdoor
privilege escalation
iis module
windows servers
china-aligned
2025-09-04
zunput
comdai
seo fraud
rungan
gamshen
2025-09-08
Published: September 8, 2025
Downloadable IOCs: 24
Click here to see more Attack Reports