Loading story…
Elastic Security Labs reported a global SEO poisoning operation compromising Windows IIS web servers using a malicious IIS module dubbed BADIIS, attributed to a Chinese-speaking cybercrime group tracked as REF4033 and aligned with Cisco Talos’ UAT-8099. The activity observed in an intrusion at a multinational organization in Southeast Asia matches prior public reporting and is assessed to have impacted 1,800+ Windows servers across multiple sectors (including government, corporate, and education) in countries spanning Asia-Pacific, Europe, and Latin America. The operation uses a two-phase workflow: serving keyword-stuffed content to search engine crawlers to manipulate rankings, then redirecting real users to monetization destinations in the “vice economy,” including online gambling, pornography, and cryptocurrency schemes.
Additional research emphasized that multiple vendors are labeling overlapping slices of the same IIS SEO-fraud ecosystem differently, and recommended consolidating hunting for UAT-8099/WEBJACK-style activity based on shared indicators and behaviors. Defensive guidance focused on detecting new/unknown IIS module registrations and suspicious DLL/module naming and staging patterns (e.g., fashttp/fasthttp/cgihttp/iis32/iis64-style DLLs; staging under paths like Desktop\VN, Desktop\newth, Public\Videos), correlating anomalous local account creation patterns (e.g., $-suffixed accounts) and remote-access tooling on web servers, and using HTTP differential-response probing (varying User-Agent, Referer, Accept-Language) to identify cloaking behavior used to selectively serve crawler vs. user content.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-01-01, WithSecure Labs published research on the WEBJACK campaign, describing IIS server hijacking used to manipulate SEO and monetize traffic through fraudulent redirection. The report established WEBJACK as a tracked cluster of IIS abuse activity later compared with Talos' UAT-8099 and Elastic's BADIIS/REF4033 reporting.
On 2026-02-11, Elastic Security Labs published detailed analysis of the BADIIS malware and attributed the activity to a Chinese-speaking cybercrime group it tracks as REF4033, noting consistency with Cisco Talos' UAT-8099. The report revealed module-loading behavior, encrypted configuration methods, campaign infrastructure, and redirection logic used in the SEO-poisoning operation.
By early 2026, a large-scale campaign using the malicious IIS native module BADIIS had compromised over 1,800 Windows IIS servers worldwide, with a strong concentration in APAC, especially China and Vietnam. The operation manipulated search rankings and redirected users to gambling, pornography, and cryptocurrency fraud destinations.
On 2026-02-10, AlphaHunt argued that Talos' UAT-8099 and WithSecure's WEBJACK should be treated as a single practical hunting cluster based on overlaps in hashes, infrastructure, victimology, and outcomes. The post also outlined technical fingerprints for distinguishing this cluster from other BadIIS-style IIS SEO-fraud activity.
In November 2025, operators later linked to the BADIIS/REF4033 activity intruded into a multinational organization in Southeast Asia. Elastic reported the actor moved from initial access to IIS module deployment in under 17 minutes, using a webshell, creating an admin user, and installing a stealthy Windows service.
On 2024-05-09, AhnLab ASEC disclosed a campaign targeting poorly managed Windows IIS servers in South Korea that manipulated search results and redirected visitors to illegal online casino sites. The report detailed the attackers' use of a malicious IIS module alongside Meterpreter, HTran, a persistence account, and ProcDump-based LSASS dumping, and published hashes and infrastructure tied to the activity.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 77 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceelastic.co
Open sourceblog.alphahunt.io
Open sourcescworld.com
Open sourceasec.ahnlab.com
Open sourcelabs.withsecure.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Chinese-speaking cybercrime group **REF4033**, also tracked as **UAT-8099**, compromised more than 1,800 Windows IIS servers worldwide to deploy the **BADIIS** malicious IIS module. Affected systems span government, corporate, education, healthcare, e-commerce, media, and financial organizations, with the largest concentration in China and Vietnam. The activity expands on previously reported BadIIS SEO-manipulation operations. After gaining initial access through an undetermined method, the operators installed a webshell, created a local administrator account, and established a stealthy Windows service before inserting BADIIS into IIS request processing. The module selectively serves SEO backlinks to search-engine crawlers and redirects qualifying visitors to gambling, pornography, prostitution, and cryptocurrency-phishing sites. Region-specific infrastructure and filters for referrers, user agents, mobile devices, and server IP subnets help conceal the abuse while monetizing the reputation and search ranking of legitimate compromised domains.
Sep 9, 2026
Cisco Talos reported a **late-2025 to early-2026** campaign attributed to China-linked **UAT-8099** targeting vulnerable **Microsoft Internet Information Services (IIS)** servers across Asia, with a notable concentration in **Thailand and Vietnam**. The actor uses **web shells** and **PowerShell** to run scripts and deploy the **GotoHTTP** remote-access tool, and has also been observed using **SoftEther VPN** and **EasyTier** to maintain control of compromised servers. The intrusions are used to deploy **BadIIS**, a malware family associated with **black-hat SEO/SEO fraud** activity. Talos assessed the activity as having significant operational overlap with WithSecure’s **WEBJACK** campaign, citing correlations across **malware hashes**, **C2 infrastructure**, **victimology**, and even the **gambling sites** being promoted. Talos also described **new BadIIS variants** that hardcode the intended target region and include customized behaviors (e.g., specific file extensions and directory indexing configurations), and noted the existence of a **Linux ELF** BadIIS variant previously uploaded to VirusTotal that supports multiple modes (including proxy, injector, and SEO-fraud).
Jun 29, 2026
A Chinese-speaking cybercrime group, tracked as UAT-8099, has been identified targeting high-value Microsoft Internet Information Services (IIS) servers across multiple countries, including India, Thailand, Vietnam, Canada, and Brazil. The group’s primary objective is to conduct search engine optimization (SEO) fraud by manipulating search rankings through the compromise of reputable IIS servers. UAT-8099 leverages a variety of tools and techniques, including the deployment of BadIIS malware, web shells, open-source hacking utilities, and Cobalt Strike to maintain persistence and evade detection on compromised systems. The attackers use customized automation scripts to further obfuscate their activities and ensure continued access. Once inside a target server, the group exploits vulnerabilities to upload web shells, which are then used to collect sensitive information such as credentials, configuration files, logs, and certificate data. This stolen data is likely packaged for resale or used in further criminal operations. Cisco Talos researchers discovered several new BadIIS malware samples associated with this campaign, noting that some clusters had very low detection rates and others contained debug strings in simplified Chinese, indicating the group’s origin. The campaign has affected a diverse set of organizations, including universities, technology companies, and telecommunications providers, highlighting the group’s broad targeting strategy. UAT-8099’s operations are financially motivated, with a focus on monetizing both the manipulation of search engine results and the theft of valuable credentials. The group also utilizes Remote Desktop Protocol (RDP) to access and further exploit compromised IIS servers. The technical sophistication of the campaign is evident in the attackers’ ability to evade traditional security measures and maintain long-term persistence. The use of reputable, high-value servers for SEO fraud increases the impact of the campaign, as these servers are more likely to influence search engine rankings. The campaign demonstrates the ongoing threat posed by financially motivated cybercrime groups leveraging advanced malware and exploitation techniques. Security researchers recommend organizations running IIS servers implement robust monitoring, patch management, and incident response procedures to detect and mitigate such threats. The exposure of configuration files and certificates also raises concerns about potential follow-on attacks, including lateral movement and further credential abuse. The campaign’s discovery underscores the importance of threat intelligence sharing and proactive defense measures in protecting critical web infrastructure.
Jun 29, 2026