Loading story…
Cisco Talos reported a late-2025 to early-2026 campaign attributed to China-linked UAT-8099 targeting vulnerable Microsoft Internet Information Services (IIS) servers across Asia, with a notable concentration in Thailand and Vietnam. The actor uses web shells and PowerShell to run scripts and deploy the GotoHTTP remote-access tool, and has also been observed using SoftEther VPN and EasyTier to maintain control of compromised servers. The intrusions are used to deploy BadIIS, a malware family associated with black-hat SEO/SEO fraud activity.
Talos assessed the activity as having significant operational overlap with WithSecure’s WEBJACK campaign, citing correlations across malware hashes, C2 infrastructure, victimology, and even the gambling sites being promoted. Talos also described new BadIIS variants that hardcode the intended target region and include customized behaviors (e.g., specific file extensions and directory indexing configurations), and noted the existence of a Linux ELF BadIIS variant previously uploaded to VirusTotal that supports multiple modes (including proxy, injector, and SEO-fraud).
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Cisco Talos published research describing the late-2025 to early-2026 UAT-8099 intrusion and SEO-fraud campaign against Asian IIS servers. The report detailed new persistence mechanisms, increased use of legitimate or red-team tools, and newly observed BadIIS variants customized by region.
Cisco Talos assessed that the UAT-8099 operation significantly overlapped with the previously documented WEBJACK campaign. The attribution was based on shared malware hashes, command-and-control infrastructure, victimology, and promoted gambling sites.
UAT-8099 deployed updated BadIIS malware on compromised IIS servers, including the Vietnam-focused IISHijack cluster and the Thailand-focused asdSearchEngine cluster. These variants filtered traffic by language or crawler behavior and redirected users or search engines to gambling and other SEO-fraud destinations.
After compromising IIS servers, the actor used web shells and PowerShell to conduct reconnaissance, create hidden local accounts such as "admin$" and "mysql$", and deploy the GotoHTTP remote access tool. The campaign also used utilities such as Sharp4RemoveLog, OpenArk64, and VPN or pivoting tools to evade detection and maintain long-term access.
A Linux ELF variant of BadIIS was uploaded to VirusTotal, indicating the malware family had expanded beyond Windows IIS environments. The sample supported proxy, injector, and SEO-fraud modes and used infrastructure consistent with later UAT-8099 reporting.
A campaign attributed to UAT-8099 began targeting vulnerable Microsoft IIS servers in Asia, with reporting indicating activity started by late 2024 and continued into 2025. Thailand and Vietnam emerged as key focus areas within the broader regional targeting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityonline.info
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Chinese-speaking cybercrime group, tracked as UAT-8099, has been identified targeting high-value Microsoft Internet Information Services (IIS) servers across multiple countries, including India, Thailand, Vietnam, Canada, and Brazil. The group’s primary objective is to conduct search engine optimization (SEO) fraud by manipulating search rankings through the compromise of reputable IIS servers. UAT-8099 leverages a variety of tools and techniques, including the deployment of BadIIS malware, web shells, open-source hacking utilities, and Cobalt Strike to maintain persistence and evade detection on compromised systems. The attackers use customized automation scripts to further obfuscate their activities and ensure continued access. Once inside a target server, the group exploits vulnerabilities to upload web shells, which are then used to collect sensitive information such as credentials, configuration files, logs, and certificate data. This stolen data is likely packaged for resale or used in further criminal operations. Cisco Talos researchers discovered several new BadIIS malware samples associated with this campaign, noting that some clusters had very low detection rates and others contained debug strings in simplified Chinese, indicating the group’s origin. The campaign has affected a diverse set of organizations, including universities, technology companies, and telecommunications providers, highlighting the group’s broad targeting strategy. UAT-8099’s operations are financially motivated, with a focus on monetizing both the manipulation of search engine results and the theft of valuable credentials. The group also utilizes Remote Desktop Protocol (RDP) to access and further exploit compromised IIS servers. The technical sophistication of the campaign is evident in the attackers’ ability to evade traditional security measures and maintain long-term persistence. The use of reputable, high-value servers for SEO fraud increases the impact of the campaign, as these servers are more likely to influence search engine rankings. The campaign demonstrates the ongoing threat posed by financially motivated cybercrime groups leveraging advanced malware and exploitation techniques. Security researchers recommend organizations running IIS servers implement robust monitoring, patch management, and incident response procedures to detect and mitigate such threats. The exposure of configuration files and certificates also raises concerns about potential follow-on attacks, including lateral movement and further credential abuse. The campaign’s discovery underscores the importance of threat intelligence sharing and proactive defense measures in protecting critical web infrastructure.
Jun 29, 2026
Cisco Talos reported that a **BadIIS** malware variant identified by embedded `demo.pdb` strings is being used as a commodity **malware-as-a-service** offering by multiple Chinese-speaking cybercrime groups. The IIS malware supports traffic redirection, reverse proxying, content hijacking, and backlink injection, enabling operators to monetize compromised web servers through **SEO fraud** and other web traffic abuse. Talos said the tooling has been under active development from at least September 2021 through January 2026, with customer-specific builds and feature changes that included antivirus evasion such as Norton bypass functionality. Researchers also recovered a builder and related installer, dropper, and persistence components tied to the string `lwxat`, which Talos assesses is likely the developer alias behind the ecosystem. The tooling can deploy both 32-bit and 64-bit BadIIS modules, register them within IIS, and restore hidden backup copies after server restarts to maintain persistence. Activity was observed mainly across the Asia-Pacific region, with additional victims in South Africa, Europe, and North America, while Talos said the shared tooling strongly links the campaigns to the same developer even though attribution to a single threat actor remains difficult.
Jun 29, 2026
ReliaQuest disclosed a newly tracked espionage cluster, **OP-512**, that targeted internet-facing Microsoft IIS servers running outdated software, including a compromised **Windows Server 2016** host using unsupported **.NET Framework 4.0**. Investigators said the actor likely maintained access for roughly 75 days before returning to deploy a custom three-file web shell framework designed to produce cryptographically unique installations, obscure forensic timelines through timestomping, and report its location back to operators through hex-encoded DNS queries with HTTP fallback. The intrusion relied on layered evasion and persistence, including randomized variable names, junk code, **RSA** signature verification, **RC4** encryption, and malicious DLLs stored in the ASP.NET temporary directory. OP-512 also loaded multiple privilege-escalation tools directly into IIS process memory, including several from the **Potato Suite** and an undocumented utility dubbed **GhostKit**; even when endpoint protection terminated malicious processes, IIS worker process restarts allowed the tooling to reload. ReliaQuest assessed the cluster with moderate-high confidence as China-linked and potentially related in tradecraft to other IIS-focused operations, while urging defenders to retire or isolate legacy .NET servers, restrict script execution in upload paths, and remediate the original access vector rather than only removing web shells.
Jun 29, 2026