Loading threat actor…
REF4033, also tracked as UAT-8099, is a Chinese-speaking cybercrime group conducting large-scale SEO-poisoning operations against Windows IIS servers. The group deploys the BADIIS malicious IIS native module to manipulate search-engine results on compromised legitimate sites and monetize their traffic. BADIIS distinguishes search crawlers from human visitors using referrer and user-agent filtering, injects keyword-rich backlinks for crawlers, and can replace selected error-page responses with attacker-controlled SEO content. Qualifying users arriving through selected search results are redirected to illicit gambling, adult-content, prostitution, and cryptocurrency-fraud destinations. The operation uses regional configuration, mobile-device targeting, and server-subnet filtering to tailor delivery and reduce exposure. REF4033 has compromised more than 1,800 servers globally, with the largest observed concentrations in China and Vietnam. Victims include government and public-administration entities, educational institutions, healthcare providers, e-commerce platforms, media organizations, financial-services organizations, and corporate environments. Observed post-compromise activity includes webshell-based enumeration, creation of local administrator accounts, installation of a stealthy Windows service, modification of IIS application-pool configuration to load BADIIS, and access hardening intended to inhibit removal or inspection. The activity is financially motivated through traffic redirection and fraudulent online services.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
11 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
65 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Operates a large-scale, geotargeted SEO poisoning and traffic-redirect monetization scheme by compromising Windows IIS servers and installing the BADIIS malicious IIS native module to inject SEO spam for crawlers and redirect real users to illicit gambling, adult content, and cryptocurrency phishing/fraud sites (e.g., Upbit impersonation).
Conducts opportunistic, large-scale SEO-poisoning operations against Windows IIS servers. It deploys the BADIIS malicious IIS module to inject SEO backlinks for search crawlers, manipulate rankings, and redirect users to illicit gambling, pornography, prostitution advertising, and cryptocurrency-phishing sites.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.