Dissecting UAT-8099: New persistence mechanisms and regional focus
Summary: Cisco Talos observed UAT-8099 activity from August 2025 through early 2026, compromising IIS servers across India, Pakistan, Thailand, Vietnam, and Japan, with concentrations in Thailand and Vietnam, and tied the campaign with high confidence to the WEBJACK activity through shared malware hashes, C2 infrastructure, victimology, and promoted gambling sites. The actor continued using web shells, SoftEther VPN, and EasyTier, created hidden accounts named "admin$" and, when that was blocked, "mysql$", and deployed two new BadIIS variants - BadIIS IISHijack targeting Vietnam and BadIIS asdSearchEngine targeting Thailand or Thai-language users via the Accept-Language header.
What's compelling: The actor's fallback from "admin$" to "mysql$" shows that blocking a single known indicator only buys time, and the region-specific archive names ("VN", "TH") mean the same infrastructure can be repointed at a new country without new tooling.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026