Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A Chinese-speaking cybercrime group, UAT-8099, is targeting high-value Internet Information Services (IIS) servers for search engine optimization fraud and data theft. The group focuses on reputable servers in India, Thailand, Vietnam, Canada, and Brazil, affecting universities, tech firms, and telecom providers. UAT-8099 uses web shells, hacking tools, Cobalt Strike, and BadIIS malware to manipulate search rankings and maintain persistence. They exploit weak file upload settings, enable guest accounts, and use RDP for access. The group also steals valuable credentials, configuration files, and certificates. New BadIIS variants with low detection rates and Chinese debug strings have been identified. The attackers employ SEO techniques like backlinking and inject malicious JavaScript to redirect users to fraudulent websites.

The UAT-8099 threat campaign involves a Chinese-speaking cybercrime group targeting high-value Internet Information Services (IIS) servers primarily for search engine optimization (SEO) fraud and data theft. The group focuses on reputable IIS servers across multiple countries, including India, Thailand, Vietnam, Canada, and Brazil, with victims spanning universities, technology firms, and telecommunications providers. The attackers leverage a combination of web shells, hacking tools, and malware such as Cobalt Strike and BadIIS variants to gain and maintain persistent access. Their initial intrusion vectors include exploiting weak file upload configurations and enabling guest accounts, as well as using Remote Desktop Protocol (RDP) for lateral movement or direct access. Once inside, they steal sensitive credentials, configuration files, and certificates, which can facilitate further compromise or enable impersonation. The BadIIS malware variants used have low detection rates and contain Chinese debug strings, indicating active development and evasion efforts. The group manipulates search engine rankings by injecting malicious JavaScript into compromised websites, redirecting users to fraudulent sites and employing backlinking SEO techniques to boost the visibility of these malicious domains. This multi-faceted approach not only allows them to monetize compromised assets through SEO fraud but also poses risks of data exfiltration and potential further exploitation of stolen credentials and certificates. The campaign is characterized by its use of advanced tools and persistence mechanisms, highlighting a sophisticated operation focused on both financial gain and information theft.

Detailed information about UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud. Get real-time updates, technical details, and mitig

UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud - Live Threat Intelligence - Threat Radar | OffSeq.com

UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud

Threats Tagged 'iis servers'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'iis servers'

Lead Pen Test Professional