Chinese Cybercrime Group Runs Global SEO Fraud Ring Using Compromised IIS Servers

Cybersecurity researchers have linked a Chinese-speaking group codenamed UAT-8099 to SEO fraud and theft of high-value credentials, configuration files and certificate data, with attacks focused on Microsoft Internet Information Services (IIS) servers. The group was first discovered in April 2025, and most infections have been reported across India, Thailand, Vietnam, Canada and Brazil, targeting universities, tech firms and telecom providers.

According to Cisco Talos, the actor manipulates search rankings by exploiting reputable IIS servers and uses web shells, open-source tools, Cobalt Strike and BadIIS malware, with automation scripts designed to evade detection. UAT-8099 is known to establish persistence, escalate privileges to administrator, and deploy Remote Desktop Protocol (RDP), often combining it with SoftEther VPN, EasyTier and FRP to maintain access.

The attackers use RDP to extract data via a GUI tool named Everything, and BadIIS malware operates in three modes: Proxy, Injector and SEO fraud, the latter coordinating backlinks to boost site rankings. The group has also been linked to other China-linked actors such as DragonRank and Operation Rewrite, while GhostRedirector was cited as compromising at least 65 Windows IIS servers last month in Brazil, Thailand and Vietnam.