Threat actor
UAT-8099
China
Tracked by CyberSIXT since 3 Oct 2025
- Articles · all time
- 4
- Articles · last 30 days
- 0
- CVEs exploited · attributed
- 0
- Research reports · all time
- 0
4 articles from 3 outlets since 3 Oct 2025; the latest 266 days ago.
- Article
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Mon 2 Feb · 01:40 UTC | SecurityOnline | IIS Under Siege: UAT-8099 Deploys Region-Locked “BadIIS” & Linux Variants |
| Fri 30 Jan · 13:35 UTC | The Hacker News | China-Linked UAT-8099 Targets IIS Servers in Asia with BadIIS SEO Malware |
| Fri 3 Oct 2025 · 13:05 UTC | Dark Reading | UAT-8099 Hijacks Reputable Sites for SEO Fraud & Theft |
| Fri 3 Oct 2025 · 03:11 UTC | SecurityOnline | UAT-8099: Chinese Group Uses BadIIS Malware on Compromised Servers for SEO Fraud and Credential Theft |
Who reported 3 outlets
- SecurityOnline2
- Dark Reading1
- The Hacker News1
Names and sources
- UAT-8099
- Named by CyberSIXT coverage
- UAT-8099
- Named by Malpedia · uat-8099
- UAT-8099
- Named by MISP Galaxy · 284151b2-6f0b-4835-9589-68a8c3287e1e
- 284151b2-6f0b-4835-9589-68a8c3287e1e
- Named by CyberSIXT coverage
Attributed facts
- origin
- China (MISP Galaxy · 284151b2-6f0b-4835-9589-68a8c3287e1e)
- IIS Under Siege: UAT-8099 Deploys Region-Locked “BadIIS” & Linux VariantsSecurityOnline
- China-Linked UAT-8099 Targets IIS Servers in Asia with BadIIS SEO MalwareThe Hacker News
- UAT-8099 Hijacks Reputable Sites for SEO Fraud & TheftDark Reading
- UAT-8099: Chinese Group Uses BadIIS Malware on Compromised Servers for SEO Fraud and Credential TheftSecurityOnline · first in our coverage