Tag: seo fraud

2 Attack Reports | 0 Vulnerabilities

Attack reports

UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud

A Chinese-speaking cybercrime group, UAT-8099, is targeting high-value Internet Information Services (IIS) servers for search engine optimization fraud and data theft. The group focuses on reputable servers in India, Thailand, Vietnam, Canada, and Brazil, affecting universities, tech firms, and tel…
data theft
cobalt strike
cybercrime
badiis
chinese-speaking
web shells
seo fraud
2025-10-02
iis servers
Published: October 2, 2025
Downloadable IOCs: 80

GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes

ESET researchers have identified a new threat actor named GhostRedirector that has compromised at least 65 Windows servers, primarily in Brazil, Thailand, and Vietnam. The actor utilizes two previously undocumented tools: a passive C++ backdoor called Rungan and a malicious Internet Information Ser…
backdoor
privilege escalation
iis module
windows servers
china-aligned
2025-09-04
zunput
comdai
seo fraud
rungan
gamshen
2025-09-08
Published: September 8, 2025
Downloadable IOCs: 24
Click here to see more Attack Reports