A Chinese-speaking cybercrime group, tracked as UAT-10147, targeting vulnerable Windows and Linux web servers worldwide to deploy BadIIS malware.

UAT-10147 Compromises Web Servers to Deploy BadIIS for SEO Fraud and Data Theft  gbhackers

UAT-10147 Compromises Web Servers to Deploy BadIIS for SEO Fraud and Data Theft  gbhackers

A Chinese-speaking cybercrime group, tracked as UAT-10147, targeting vulnerable Windows and Linux web servers worldwide to deploy BadIIS malware.

中国語圏のサイバー犯罪集団「UAT-10147」が、世界各地の脆弱なWindowsおよびLinux Webサーバーを標的にBadIISマルウェアを展開し、データを窃取した上で検索エンジンの表示結果を不正操作し、金銭的利益を得ていることが分かりました。アンチマルウェアソフトウェア Talosはブラジル、ボリビア、中国、

The actor tracked as UAT-10147, or x神 (xshen), is running SPECTRE, a cross-platform implant that pairs a Linux rootkit with bring-your-own-vulnerable-driver activity. Associated tooling also includes BadIIS, Havoc, RTCore64, and DBUtil.

Cisco Talos discovered a Chinese-speaking cybercrime group, tracked as UAT-10147, that targets a wide range of vulnerable web servers. This is an overview of the campaign, examining the countries affected, potential impact of BadIIS infections, the attack chain, and post-compromise tactics.

Des pirates exploitent les serveurs IIS pour propager le malware BadIIS, manipulant le SEO et redirigeant les internautes vers des sites frauduleux.

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape.

Cisco Talos is disclosing a new threat called “DragonRank” that primarily targets countries in Asia and a few in Europe, operating PlugX and BadIIS for search engine optimization (SEO) rank manipulati...

Chinese hackers launch DragonRank campaign, targeting multiple countries for SEO manipulation using BadIIS malware and compromised IIS servers.

Elastic Security Labs has published comprehensive research on BADIIS, a malicious IIS module deployed in a large-scale SEO poisoning campaign

Cybersecurity researchers have discovered a new campaign attributed to a China-linked threat actor known as UAT-8099 that took place between late 2025 and early 2026. The activity, discovered by Cisco Talos, has targeted vulnerable Internet Information Services (IIS) servers located across Asia, but with a specific focus on targets in Thailand and Vietnam. The scale of the campaign is currently

China linked threat group UAT 8099 is targeting IIS servers across Asia with BadIIS SEO malware to manipulate search results and traffic.

Over 1,800 Windows IIS servers were compromised by BADIIS malware in a stealthy global SEO poisoning campaign. The post 1,800+ Windows Servers Hit by BADIIS SEO Malware appeared first on eSecurity Planet.

Fortinet exploit, Chrome 0-Day, BadIIS malware, SaaS breach, and record DDoS — plus 15+ top stories shaping this week in cybersecurity.

  There was an ongoing quiet, methodical campaign unfolding across many sections of the web infrastructure in Asia by the spring of 2025, a campaign which did not rely on loud disruptions or overt destruction, but instead relied on subtle manipulation of trust.  Cisco Talos researchers have discovered evidence that a Chinese-speaking threat group known as UAT-8099 has been systematically infiltrating vulnerable Microsoft Internet Information Services (IIS) servers that hold established credibility within their region's digital eco-systems as a result of ongoing campaign of spam attacks.  In contrast to targeting any system that could be compromised indiscriminately, the attackers opted for high-reputation servers, leveraging the ranking of such servers to manipulate search engine results and generate illicit revenue rather than targeting every exposed system.  With a specialized SEO fraud operation, UAT-8099 also combined its manipulation with deeper post-compromised activity by accessing compromised systems with Remote Desktop Protocol access and searching for sensitive certificates, credentials, configuration files, and logs, assets which could be repurposed in follow-on attacks or aquired quietly into underground markets, making it a powerful enterprise. In this instance, it underscores the persistent threat posed by exposing, internet-facing infrastructure, especially in cases where critical services are exposed, and are vulnerable to compromise. According to Cisco Talos findings, UAT-8099 has demonstrated that it has taken a multifaceted approach to compromising a system, as it does not merely consider susceptible IIS servers to be entry points but also as long-term assets in its criminal workflow as a whole.  By gaining access to these systems, the group then uses them as a covert way to forward searches in mobile search to spam-driven advertising networks and gambling platforms that are illicit, allowing them to monetize the established credibility of well-known organizations.  Meanwhile, the attackers harvest sensitive information contained on the servers in a systematic manner, including authentication information as well as internal access records, which may be used for later intrusions or are sold on underground markets in order to maintain control over the servers.  There are some operations that are common to Chinese-language SEO fraud collectives that exhibit UAT-8099's operational characteristics—and they are similar to the clusters that have been tracked by other security firms such as GhostRedirector and CL-UNK-1037. However, the boundaries between these groups remain indistinct, indicating that financial motivations play an integral role in the evolution of cybercrime. There is some evidence that indicates that the activity is linked to a Chinese-based threat cluster that has been ongoing since April 2025, with operational evidence indicating that the campaign began in April of that year. The analysis also shows significant parallels with a separate BadIIS attack, identified by WithSecure as WEBJACK by Finnish cybersecurity firm WithSecure, which includes similar tooling, command-and-control infrastructures, and patterns in victim selection. Cisco Talos has observed a significant increase in activity against IIS servers located in India, Pakistan, Thailand, Vietnam, and Japan during the recent wave of activity. In particular, Cisco Talos has noted an increase in targeting in Thailand and Vietnam. This geographic focus reflects a broader refinement in the group's targeting strategy, which is why the attackers prioritize regions where compromised servers can be exploited in order to monetize and maintain long-term control.  The Talos researchers have noted that UAT-8099 has shown a significant evolution in terms of its tradecraft from a technical perspective. The group is still relying on web shells and network utilities like SoftEther VPN and EasyTier to maintain access to infected servers, but it has increasingly incorporated red team frameworks and legitimate administrative tools in order to reduce its footprint and extend its longevity.  An initial attack typically involves exploiting vulnerabilities within IIS environments or misconfigured file upload mechanisms to gain access to the host system. Once the attackers have embedded themselves within the host system, they conduct reconnaissance in order to profile it, create concealed user accounts to establish persistence, and set up utilities aimed at suppressing forensic visibility, disabling defensive controls, and facilitating remote control of the system. This attack ensures uninterrupted operation of the SEO fraud infrastructure by dynamically adjusting the persistence mechanisms to counter detection measures that flag previously used account names. As a result, attackers create alternative hidden accounts to ensure their persistence mechanisms are constantly adjusted.  BadIIS malware represents the last stage of the attack chain, and variants have been observed that have been specifically tailored for regional audiences. A strain of the virus was specifically developed to target systems in Vietnam, while another strain of the virus was designed specifically for Thai-based environments or users who speak the Thai language. It intercepts and evaluates inbound web traffic, identifies search engine crawlers, and covertly redirects them to fraudulent SEO sites despite these customizations. By injecting malicious scripts into server responses, the malware manipulates server responses for ordinary users, particularly those whose browser language settings match the targeted region.  There is a twin-path approach to this operation, which enables them to quietly manipulate search rankings without the risk of being discovered by legitimate visitors, increasing the significance of the group's emphasis on stealth and sustained exploitation as a result.  Despite its importance as a foundational component of web infrastructure for organizations across sectors, Microsoft Internet Information Services remains one of the most easily abused components of the Internet. When the security controls on the IIS environment are not adequate, it is an easy target for abuse. Threat actors have proven that compromised IIS environments can be repurposed to deliver malicious or misleading content to unwitting visitors, effectively turning trusted websites into distribution points for criminals.  There have been recent examples in which newly observed malware variants were primarily used to promote online gambling content, although security experts caution that this technique is easily capable of being applied to large-scale malware delivery or carefully crafted watering hole attacks that target specific audiences as well.  It is worth emphasizing that unsecured web servers that retain outward signs of legitimacy pose a broader risk than simply adapting to these methods. In addition to technical disruption, the consequences of a misuse of a reputable website can have long-term consequences for organizations affected.  A misuse of a reputable website can lead to a loss of user confidence, erode reputations, and expose site owners to a variety of legal and regulatory scrutiny, especially when they are found to have a role in malicious activity. Those who work in the field of cybersecurity emphasize the importance of disciplined server management as well as proactive defense measures in order to reduce such risks. ' Among the key tasks that must be accomplished is maintaining a clear inventory of internet-facing assets, applying security updates on a timely basis, and closely monitoring the IIS environments for irregular modules installed or binaries placed in unanticipated locations.  An attacker's ability to operate undetected can be further hindered if additional safeguards are put in place, such as limiting administrative access, enforcing strong authentication mechanisms backed by multifactor authentication, and regulating inbound and outbound traffic using firewalls.  It remains important to perform continuous log analysis in order to minimize the attack surface of IIS deployments while maintaining their integrity. It is clear that UAT-8099's activities have a major impact on the stolen sensitive data from compromised environments, both immediately and tangiblely.  Once access has been secured, this group reinforces its foothold by deploying additional backdoors, as well as commercial-grade post-exploitation frameworks, and they proceed to collect credentials, configuration files, and digital certificates that are used to support additional intrusions or that can be monetized through underground channels in order to strengthen its foothold.  The secondary layer of exploitation aims to exploit vulnerable IIS servers to create staging points for larger campaigns, extending the risk much further than the initial compromise, and increasing the value of the targeted systems as a result. However, much of the group’s activity remains largely unknown both to the affected organizations as well as to the users of the website, making detection and response a challenging task.  There is a tendency for site owners to dismiss external warnings as false positives since the integrity and outward appearance of compromised websites usually remain the same, and it is believed that no visible changes equate to the lack of intrusion on the compromised website.  The perception gap, according to practitioners in threat intelligence, is often at the core of remediation efforts, despite attempts at the national and sectorion levels of alerting organizations to covert compromises. In spite of the fact that the immediate effects may seem abstract or low priority, experts warn that the underlying vulnerabilities that are being exploited are anything but benign.  In the same way that hackers can silently manipulate content or insert hidden redirects by utilizing the same weaknesses, malicious scripts can also be injected into a system that will harvest session cookies, login credentials, and payment information from legitimate users, putting organizations at greater risk than they ever imagined. It was revealed by an analysis of the latest BadIIS variants that they were designed in a modular way that supported a variety of operational modes while remaining undetected. As the malware is working in proxy mode, it validates the request paths and decodes an embedded command-and-control address. This address is used by the malware as an intermediary for fetching content from secondary infrastructure, which is then relayed back through the Internet Information System.  It is important to note that the responses submitted to search engines are modified before they are routed. This is done to simulate legitimate HTTP traffic with content being injected directly into the bodies of response via native IIS APIs, ensuring seamless delivery without affecting the server itself.  Additionally, the malware's SEO fraud capability relies on large-scale backlink manipulation: exploiting compromised servers, it displays search engines with HTML-based link structures intended to artificially inflate rankings for attacker-controlled domains, thereby attempting to fool search engines into believing users are the owner of the site.  There is also an injector mode that enables users tasked with searching for the answer to a search query, retrieved JavaScript from remote servers and embedded in web responses to trigger covert redirections, which can be used with this approach. When operators host redirect logic externally instead of within the malware itself, they have the option of switching destinations, localizing messages by region, and evading signature-based defenses.  Additionally, a second cluster of BadIIS samples enhances these capabilities by implementing additional request-handling mechanisms to enforce redirects at multiple stages of the HTTP lifecycle and supporting a variety of hijacking scenarios ranging from a complete site replacement to selective homepage redirection or path-based proxying, as well as providing different levels of functionality.  All these features are taken together to demonstrate a mature, adaptable framework, capable of manipulating search ecosystems as well as exploiting trust web infrastructure for long-term abuse without being visible to victims or their families. It's important to mention that security experts caution that this campaign highlights what is arguably one of the most serious risks facing organizations that use internet-facing web infrastructure to function.  There is a possibility that IIS servers, which have not been properly hardened, will gradually become long-term assets for cybercriminal operations without causing immediate operational alarms when left unhardened.  As a result, organizations should reassess their web environments' security posture, and to treat reputation and visibility as potential risks, rather than as safeguards, as they might be. There is an increasing need for proactive patch management, strict access controls, continuous monitoring, and regular integrity checks, which are regarded not as best practices but as a fundamental requirement.  Campaigns such as UAT-8099 show us that despite the absence of visible disruption, compromise is still a threat, and organizations and their users may suffer far more severe outcomes if they fail to address these silent threats in the future.

A Huntress investigation shows how an attacker used a SQL injection flaw to gain access, then spent time entrenching on the system by enabling Remote Desktop, creating admin users, disabling Windows Defender, and deploying BadIIS and XMRig. The case highlights that post-breach cleanup is not enough unless defenders also fix the original entry point and harden the environment against repeat access. #Huntress #BadIIS #XMRig

WhoisXML API expanded on Cisco Talos’s research into the UAT-8099 campaign, identifying 27 IoCs (10 domains and 17 subdomains), DNS resolution histories, WHOIS history artifacts, and thousands of email-connected domains with several malicious ties. The actor exploited vulnerable IIS servers—using web shells, PowerShell, BadIIS variants, and the GotoHTTP remote-access tool—primarily targeting hosts in Thailand and Vietnam. #UAT-8099 #GotoHTTP

Threat actors have been observed targeting Internet Information Services (IIS) servers in Asia as part of a search engine optimization (SEO) manipulation campaign designed to install BadIIS malware. "It is likely that the campaign is financially motivated since redirecting users to illegal gambling websites shows that attackers deploy BadIIS for profit," Trend Micro researchers Ted Lee and