UAT-8099 Hijacks Reputable Sites for SEO Fraud & Theft

A Chinese-language threat actor is infecting Internet Information Services (IIS) servers at reputable organisations, hijacking the sites for SEO fraud and data theft, according to Cisco Talos researchers. The operation, dubbed UAT-8099, uses all parts of the kill chain—from compromising vulnerable, Internet-facing servers and uploading an OSS web shell to escalating privileges, enabling RDP and deploying various reverse proxy and VPN tools.

It also drops a backdoor, including a Cobalt Strike variant, to harvest credentials, configuration files and certificate information for follow-on attacks or sale on the Dark Web. A key implant called BadIIS sits on a victim site and can redirect both search engine crawlers and human visitors to spam advertisements and gambling sites, leveraging the compromised site's reputation to boost SEO and deception.

The activity has been observed across multiple regions, with victims including technology companies, telecoms providers and universities in countries such as Brazil, Canada, India, Thailand and Vietnam; Nate Nelson notes the attackers aim to monetise access and extend their reach.