UAT-8099: Chinese Group Uses BadIIS Malware on Compromised Servers for SEO Fraud and Credential Theft

Cisco Talos researchers describe UAT-8099, a Chinese-speaking cybercrime group that uses compromised Microsoft IIS servers to carry out SEO fraud and to steal high-value credentials, configuration files and certificate data.

According to Cisco Talos, the group exploits weak IIS upload restrictions to plant web shells, establishing initial access and giving them control over the compromised server, then enables a guest account, elevates privileges to administrator, and activates RDP for long-term access while creating hidden administrator accounts for persistence.

They also deploy Cobalt Strike beacons for deeper post‑exploitation, using DLL sideloading with inetinfo.exe and a multi‑stage loader chain, with the third stage described as the User-Defined Reflective Loader for the Cobalt Strike beacon. To blend in with normal traffic, they use various tools and methods, including SoftEther VPN, EasyTier and FRP reverse proxy, and they install a customized BadIIS malware directly on the servers to manipulate search rankings and inject malicious JavaScript.

The attackers target high‑value IIS servers across regions including universities, tech firms, and telecommunications providers in India, Thailand, Vietnam, Canada and Brazil, and Cisco observed two distinct clusters, one with very low antivirus detection rates.