Loading story…
A Chinese-speaking threat actor, tracked as CL-UNK-1037, is conducting a sophisticated SEO poisoning campaign using custom IIS malware called BadIIS. The campaign targets East and Southeast Asia, compromising legitimate web servers to manipulate search results and redirect users to scam or illicit sites. The attackers employ multiple malware variants and share infrastructure with known groups such as Group 9 and DragonRank.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Unit 42 publicly reported that Operation Rewrite was operated with high confidence by a Chinese-speaking threat actor based on linguistic artifacts and infrastructure patterns. The report also linked CL-UNK-1037 to ESET's Group 9 with moderate confidence and noted low-confidence similarities to DragonRank.
As the investigation expanded, analysts discovered additional samples and infrastructure tied to the campaign, including 008php.com-family C2 domains. They also identified undocumented variants beyond native IIS modules, including an ASP.NET page handler, a managed .NET IIS module, and an all-in-one PHP script for cloaking, proxying, and sitemap rewriting.
During the campaign, the operators moved laterally to production servers and domain controllers, deployed additional web shells, created scheduled tasks and local users, and staged ZIP archives of web application source code in web-accessible paths for exfiltration. The activity showed a geographic focus on East and Southeast Asia, especially Vietnam.
In March 2025, researchers uncovered a wide-scale SEO poisoning campaign dubbed Operation Rewrite and tracked it as CL-UNK-1037. The activity involved compromised legitimate servers running BadIIS to manipulate search engine results and redirect users to scam content.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecurityonline.info
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Chinese-speaking cybercrime group **REF4033**, also tracked as **UAT-8099**, compromised more than 1,800 Windows IIS servers worldwide to deploy the **BADIIS** malicious IIS module. Affected systems span government, corporate, education, healthcare, e-commerce, media, and financial organizations, with the largest concentration in China and Vietnam. The activity expands on previously reported BadIIS SEO-manipulation operations. After gaining initial access through an undetermined method, the operators installed a webshell, created a local administrator account, and established a stealthy Windows service before inserting BADIIS into IIS request processing. The module selectively serves SEO backlinks to search-engine crawlers and redirects qualifying visitors to gambling, pornography, prostitution, and cryptocurrency-phishing sites. Region-specific infrastructure and filters for referrers, user agents, mobile devices, and server IP subnets help conceal the abuse while monetizing the reputation and search ranking of legitimate compromised domains.
Sep 9, 2026
A Chinese-speaking cybercrime group, tracked as UAT-8099, has been identified targeting high-value Microsoft Internet Information Services (IIS) servers across multiple countries, including India, Thailand, Vietnam, Canada, and Brazil. The group’s primary objective is to conduct search engine optimization (SEO) fraud by manipulating search rankings through the compromise of reputable IIS servers. UAT-8099 leverages a variety of tools and techniques, including the deployment of BadIIS malware, web shells, open-source hacking utilities, and Cobalt Strike to maintain persistence and evade detection on compromised systems. The attackers use customized automation scripts to further obfuscate their activities and ensure continued access. Once inside a target server, the group exploits vulnerabilities to upload web shells, which are then used to collect sensitive information such as credentials, configuration files, logs, and certificate data. This stolen data is likely packaged for resale or used in further criminal operations. Cisco Talos researchers discovered several new BadIIS malware samples associated with this campaign, noting that some clusters had very low detection rates and others contained debug strings in simplified Chinese, indicating the group’s origin. The campaign has affected a diverse set of organizations, including universities, technology companies, and telecommunications providers, highlighting the group’s broad targeting strategy. UAT-8099’s operations are financially motivated, with a focus on monetizing both the manipulation of search engine results and the theft of valuable credentials. The group also utilizes Remote Desktop Protocol (RDP) to access and further exploit compromised IIS servers. The technical sophistication of the campaign is evident in the attackers’ ability to evade traditional security measures and maintain long-term persistence. The use of reputable, high-value servers for SEO fraud increases the impact of the campaign, as these servers are more likely to influence search engine rankings. The campaign demonstrates the ongoing threat posed by financially motivated cybercrime groups leveraging advanced malware and exploitation techniques. Security researchers recommend organizations running IIS servers implement robust monitoring, patch management, and incident response procedures to detect and mitigate such threats. The exposure of configuration files and certificates also raises concerns about potential follow-on attacks, including lateral movement and further credential abuse. The campaign’s discovery underscores the importance of threat intelligence sharing and proactive defense measures in protecting critical web infrastructure.
Jun 29, 2026
Elastic Security Labs reported a **global SEO poisoning operation** compromising Windows **IIS** web servers using a malicious IIS module dubbed **BADIIS**, attributed to a Chinese-speaking cybercrime group tracked as **REF4033** and aligned with Cisco Talos’ **UAT-8099**. The activity observed in an intrusion at a multinational organization in Southeast Asia matches prior public reporting and is assessed to have impacted **1,800+ Windows servers** across multiple sectors (including government, corporate, and education) in countries spanning Asia-Pacific, Europe, and Latin America. The operation uses a two-phase workflow: serving keyword-stuffed content to search engine crawlers to manipulate rankings, then redirecting real users to monetization destinations in the “vice economy,” including **online gambling**, pornography, and cryptocurrency schemes. Additional research emphasized that multiple vendors are labeling overlapping slices of the same IIS SEO-fraud ecosystem differently, and recommended consolidating hunting for **UAT-8099/WEBJACK**-style activity based on shared indicators and behaviors. Defensive guidance focused on detecting **new/unknown IIS module registrations** and suspicious DLL/module naming and staging patterns (e.g., `fashttp/fasthttp/cgihttp/iis32/iis64`-style DLLs; staging under paths like `Desktop\VN`, `Desktop\newth`, `Public\Videos`), correlating anomalous local account creation patterns (e.g., **`$`-suffixed accounts**) and remote-access tooling on web servers, and using **HTTP differential-response probing** (varying `User-Agent`, `Referer`, `Accept-Language`) to identify cloaking behavior used to selectively serve crawler vs. user content.
Jun 29, 2026