UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud
Summary: Cisco Talos identified a Chinese-speaking cybercrime group, UAT-8099, in April 2025 targeting vulnerable IIS servers in India, Thailand, Vietnam, Canada and Brazil to manipulate search engine results for financial gain. The group uploads an ASP.NET web shell through unrestricted file upload features, enables a guest account with administrator privileges, installs BadIIS malware, and uses RDP, SoftEther VPN, EasyTier and FRP for persistence while exfiltrating credentials, configuration files and certificates.
What's compelling: The compromised servers belong to universities, technology companies and telecommunications providers, and redirect mobile users to unauthorized advertisements or illegal gambling sites. UAT-8099 also packages stolen credentials and certificates for resale, meaning a single unpatched file-upload setting can hand over both your web reputation and your authentication material.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026