UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud

A Chinese-speaking cybercrime group, UAT-8099, is targeting high-value Internet Information Services (IIS) servers for search engine optimization fraud and data theft. The group focuses on reputable servers in India, Thailand, Vietnam, Canada, and Brazil, affecting universities, tech firms, and telecom providers. UAT-8099 uses web shells, hacking tools, Cobalt Strike, and BadIIS malware to manipulate search rankings and maintain persistence. They exploit weak file upload settings, enable guest accounts, and use RDP for access. The group also steals valuable credentials, configuration files, and certificates. New BadIIS variants with low detection rates and Chinese debug strings have been identified. The attackers employ SEO techniques like backlinking and inject malicious JavaScript to redirect users to fraudulent websites.

• Agentic AI Uncovers New China-Linked Cluster OP-512Malware2026-06-05
• Inside a network of 20,000+ fake shopsCampaign2026-03-18
• NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779ExploitedMalware2026-10-20
• Inside a Global AI-Assisted Hacking CampaignMalware2026-10-22
• Q3 2026 Statistical Report on Malware Targeting Windows Database ServersMalware2026-10-14