IIS Servers Compromised by Chinese Hackers for SEO Manipulation

According to Cisco Talos, UAT-8099, a Chinese-speaking cybercrime group, has been exploiting vulnerable Internet Information Services (IIS) servers across multiple countries to conduct search engine optimisation (SEO) fraud and steal high-value data. Identified in April 2025, the group targets reputable IIS servers in India, Thailand, Vietnam, Canada and Brazil, focusing on universities, technology firms and telecommunications providers.

Their campaign aims to boost the search rankings of malicious sites and redirect legitimate traffic to unauthorized advertisements and illegal gambling platforms. The operation begins with reconnaissance on unpatched IIS servers that allow unrestricted file uploads, after which an open-source ASP.NET web shell is uploaded to execute commands and gather system information.

They then create and elevate a guest user account to administrator privileges to enable RDP access, deploy web shells, and use tools including Cobalt Strike to establish persistence. Cisco Talos urges organisations to secure IIS servers by applying patches, restricting file upload types, enforcing strong account policies and deploying robust monitoring.