WhoisXML API revealed 27 IoCs linked to UAT-8099, expanding on Cisco Talos’s findings. The campaign targeted vulnerable IIS servers using web shells, PowerShell, and GotoHTTP tools in Thailand and Vietnam. #UAT8099 #GotoHTTP #Thailand
Unearthing DNS Facts about UAT-8099
WhoisXML API expanded on Cisco Talos’s research into the UAT-8099 campaign, identifying 27 IoCs (10 domains and 17 subdomains), DNS resolution histories, WHOIS history artifacts, and thousands of email-connected domains with several malicious ties. The actor exploited vulnerable IIS servers—using web shells, PowerShell, BadIIS variants, and the GotoHTTP remote-access tool—primarily targeting hosts in Thailand and Vietnam. #UAT-8099 #GotoHTTP
www.hendryadrian.com
April 29, 2026 at 10:30 PM
China-linked UAT-8099 targets IIS servers in Asia with BadIIS malware, focusing on SEO fraud. Stay vigilant! #CyberSecurity #SEO #Malware #IIS #UAT8099 Link: thedailytechfeed.com/china-linked...
January 31, 2026 at 4:38 PM
China-linked UAT-8099 targets IIS servers in Asia with BadIIS malware, focusing on SEO fraud. Stay vigilant! #CyberSecurity #SEO #Malware #IIS #UAT8099 Link: thedailytechfeed.com/china-linked...
Alert: UAT-8099 targets IIS servers in Asia with region-specific BadIIS malware. Ensure your systems are patched and secure. #CyberSecurity #IIS #BadIIS #UAT8099 #ThreatAlert Link: thedailytechfeed.com/cyber-attack...
January 31, 2026 at 3:56 PM
Alert: UAT-8099 targets IIS servers in Asia with region-specific BadIIS malware. Ensure your systems are patched and secure. #CyberSecurity #IIS #BadIIS #UAT8099 #ThreatAlert Link: thedailytechfeed.com/cyber-attack...
Il gruppo cinese UAT-8099 sfrutta server IIS vulnerabili con SEO fraud, BadIIS e Cobalt Strike, colpendo aziende globali con furti credenziali e redirect fraudolenti.
#apt #BadIIS #cina #CobaltStrike #iis #SEO #SEOBadIIS #UAT8099
www.matricedigitale.it/2025/10/02/u...
#apt #BadIIS #cina #CobaltStrike #iis #SEO #SEOBadIIS #UAT8099
www.matricedigitale.it/2025/10/02/u...
October 2, 2025 at 1:26 PM
Il gruppo cinese UAT-8099 sfrutta server IIS vulnerabili con SEO fraud, BadIIS e Cobalt Strike, colpendo aziende globali con furti credenziali e redirect fraudolenti.
#apt #BadIIS #cina #CobaltStrike #iis #SEO #SEOBadIIS #UAT8099
www.matricedigitale.it/2025/10/02/u...
#apt #BadIIS #cina #CobaltStrike #iis #SEO #SEOBadIIS #UAT8099
www.matricedigitale.it/2025/10/02/u...
A clean event log isn't safety—it’s a warning. 🛡️
In our UAT-8099 finale, I expose the 'Ferocious Persistence' tools like Sharp4RemoveLog that automate quiet occupancy on your IIS servers. Don't wait until it’s too late. Full Forensic_mind_LOG v1.6 findings are live. 👇
#CyberSecurity #UAT8099
In our UAT-8099 finale, I expose the 'Ferocious Persistence' tools like Sharp4RemoveLog that automate quiet occupancy on your IIS servers. Don't wait until it’s too late. Full Forensic_mind_LOG v1.6 findings are live. 👇
#CyberSecurity #UAT8099
The Ferocious Persistence Toolkit of UAT-8099 (Part 4 of 4)
If you think a 'clean' event log means you’re safe, you’ve already lost the forensic battle. Senior Analyst Michael Ransier dissects the ferocious persistence tools of UAT-8099—from Sharp4RemoveLog to the GotoHTTP stealth agent—revealing how to secure your IIS perimeter against automated quiet occupancy
thecybermind.co
February 5, 2026 at 2:59 PM
A clean event log isn't safety—it’s a warning. 🛡️
In our UAT-8099 finale, I expose the 'Ferocious Persistence' tools like Sharp4RemoveLog that automate quiet occupancy on your IIS servers. Don't wait until it’s too late. Full Forensic_mind_LOG v1.6 findings are live. 👇
#CyberSecurity #UAT8099
In our UAT-8099 finale, I expose the 'Ferocious Persistence' tools like Sharp4RemoveLog that automate quiet occupancy on your IIS servers. Don't wait until it’s too late. Full Forensic_mind_LOG v1.6 findings are live. 👇
#CyberSecurity #UAT8099