Loading story…
Chinese-speaking cybercrime group REF4033, also tracked as UAT-8099, compromised more than 1,800 Windows IIS servers worldwide to deploy the BADIIS malicious IIS module. Affected systems span government, corporate, education, healthcare, e-commerce, media, and financial organizations, with the largest concentration in China and Vietnam. The activity expands on previously reported BadIIS SEO-manipulation operations.
After gaining initial access through an undetermined method, the operators installed a webshell, created a local administrator account, and established a stealthy Windows service before inserting BADIIS into IIS request processing. The module selectively serves SEO backlinks to search-engine crawlers and redirects qualifying visitors to gambling, pornography, prostitution, and cryptocurrency-phishing sites. Region-specific infrastructure and filters for referrers, user agents, mobile devices, and server IP subnets help conceal the abuse while monetizing the reputation and search ranking of legitimate compromised domains.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Elastic Security Labs observed a REF4033 intrusion affecting a multinational organization based in Southeast Asia. The actors progressed from initial access to IIS-module deployment in under 17 minutes, using a webshell, an added local administrator account, and the WalletServiceInfo service to load BADIIS.
Chinese-speaking cybercrime group REF4033, also tracked as UAT-8099, compromised more than 1,800 Windows IIS servers globally and deployed the BADIIS malicious IIS module. The operation monetized legitimate sites by injecting search-engine backlinks and redirecting selected visitors to gambling, adult, prostitution, and cryptocurrency-fraud sites.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 65 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
elastic.co
Open sourcetrendmicro.com
Open sourceired.team
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs reported a **global SEO poisoning operation** compromising Windows **IIS** web servers using a malicious IIS module dubbed **BADIIS**, attributed to a Chinese-speaking cybercrime group tracked as **REF4033** and aligned with Cisco Talos’ **UAT-8099**. The activity observed in an intrusion at a multinational organization in Southeast Asia matches prior public reporting and is assessed to have impacted **1,800+ Windows servers** across multiple sectors (including government, corporate, and education) in countries spanning Asia-Pacific, Europe, and Latin America. The operation uses a two-phase workflow: serving keyword-stuffed content to search engine crawlers to manipulate rankings, then redirecting real users to monetization destinations in the “vice economy,” including **online gambling**, pornography, and cryptocurrency schemes. Additional research emphasized that multiple vendors are labeling overlapping slices of the same IIS SEO-fraud ecosystem differently, and recommended consolidating hunting for **UAT-8099/WEBJACK**-style activity based on shared indicators and behaviors. Defensive guidance focused on detecting **new/unknown IIS module registrations** and suspicious DLL/module naming and staging patterns (e.g., `fashttp/fasthttp/cgihttp/iis32/iis64`-style DLLs; staging under paths like `Desktop\VN`, `Desktop\newth`, `Public\Videos`), correlating anomalous local account creation patterns (e.g., **`$`-suffixed accounts**) and remote-access tooling on web servers, and using **HTTP differential-response probing** (varying `User-Agent`, `Referer`, `Accept-Language`) to identify cloaking behavior used to selectively serve crawler vs. user content.
Jun 29, 2026
A Chinese-speaking cybercrime group, tracked as UAT-8099, has been identified targeting high-value Microsoft Internet Information Services (IIS) servers across multiple countries, including India, Thailand, Vietnam, Canada, and Brazil. The group’s primary objective is to conduct search engine optimization (SEO) fraud by manipulating search rankings through the compromise of reputable IIS servers. UAT-8099 leverages a variety of tools and techniques, including the deployment of BadIIS malware, web shells, open-source hacking utilities, and Cobalt Strike to maintain persistence and evade detection on compromised systems. The attackers use customized automation scripts to further obfuscate their activities and ensure continued access. Once inside a target server, the group exploits vulnerabilities to upload web shells, which are then used to collect sensitive information such as credentials, configuration files, logs, and certificate data. This stolen data is likely packaged for resale or used in further criminal operations. Cisco Talos researchers discovered several new BadIIS malware samples associated with this campaign, noting that some clusters had very low detection rates and others contained debug strings in simplified Chinese, indicating the group’s origin. The campaign has affected a diverse set of organizations, including universities, technology companies, and telecommunications providers, highlighting the group’s broad targeting strategy. UAT-8099’s operations are financially motivated, with a focus on monetizing both the manipulation of search engine results and the theft of valuable credentials. The group also utilizes Remote Desktop Protocol (RDP) to access and further exploit compromised IIS servers. The technical sophistication of the campaign is evident in the attackers’ ability to evade traditional security measures and maintain long-term persistence. The use of reputable, high-value servers for SEO fraud increases the impact of the campaign, as these servers are more likely to influence search engine rankings. The campaign demonstrates the ongoing threat posed by financially motivated cybercrime groups leveraging advanced malware and exploitation techniques. Security researchers recommend organizations running IIS servers implement robust monitoring, patch management, and incident response procedures to detect and mitigate such threats. The exposure of configuration files and certificates also raises concerns about potential follow-on attacks, including lateral movement and further credential abuse. The campaign’s discovery underscores the importance of threat intelligence sharing and proactive defense measures in protecting critical web infrastructure.
Jun 29, 2026
A Chinese-speaking threat actor, tracked as CL-UNK-1037, is conducting a sophisticated SEO poisoning campaign using custom IIS malware called BadIIS. The campaign targets East and Southeast Asia, compromising legitimate web servers to manipulate search results and redirect users to scam or illicit sites. The attackers employ multiple malware variants and share infrastructure with known groups such as Group 9 and DragonRank.
Jun 29, 2026