Summary:

UAT-8099, a China-affiliated threat actor, is actively compromising poorly secured Microsoft IIS servers across Asia to deploy BadIIS malware for large-scale SEO manipulation and persistent server abuse, with observed concentration in Thailand and Vietnam. Active from late 2025 through early 2026, the campaign leverages web shells, PowerShell loaders, and legitimate red-team tooling to evade detection, create concealed local user accounts, and maintain long-term access via VPN-based remote connectivity. BadIIS payloads selectively target search engine crawlers and region-specific users to manipulate search rankings while minimizing exposure to administrators and security controls. This activity reflects a maturing tradecraft focused on stealth, geographic targeting, and operational resilience, posing both security and reputational risks to affected organizations.

Technical Description:

The UAT-8099 intrusion chain begins with the exploitation of vulnerable or misconfigured IIS servers, most commonly through weak server-side file-upload controls that allow arbitrary file execution. Following initial compromise, web shells are deployed to establish command execution, after which PowerShell-based loaders are used to stage additional tooling. Persistence is achieved through the creation of concealed local user accounts (for example, admin$ or mysql$), host reconnaissance, and the deployment of VPN utilities such as SoftEther and EasyTier, combined with GotoHTTP for remote command execution initiated via VBScript.

Defense evasion techniques include using tools such as Sharp4RemoveLog to delete Windows event logs, CnCrypt Protect to obscure malicious artifacts, and OpenArk64 to disable or terminate security processes. BadIIS malware variants are then installed to selectively hook dynamic IIS content, identify search engine crawlers or region-specific language indicators, and inject malicious redirects or JavaScript payloads. This selective manipulation enables sustained SEO poisoning while reducing error generation, logging artifacts, and the likelihood of operational detection.

Delivery and Infection Chain:

UAT-8099 primarily gains initial access by exploiting unpatched IIS vulnerabilities or abusing insecure file upload mechanisms that allow arbitrary script execution. Once access is obtained, web shells are deployed to establish a foothold and enable interactive command execution. PowerShell is then used to download and execute secondary payloads, transitioning the compromise from opportunistic access to a controlled and persistent intrusion within the IIS environment. The infection chain was identified as follows:

• Initial access is achieved by exploiting unpatched IIS vulnerabilities or insecure file upload mechanisms to deploy a web shell.
• The threat actor performs system discovery and executes PowerShell commands to download and stage additional tools and payloads.
• Persistence is established through the creation of hidden local user accounts (e.g., admin$, mysql$) and the deployment of VPN utilities to enable sustained remote access.
• Defense evasion techniques are applied, including clearing Windows event logs, concealing malicious artifacts, and terminating security-related processes.
• BadIIS malware variants are deployed to selectively inject redirects or JavaScript into IIS responses, targeting search engine crawlers and region-specific users for SEO poisoning.

Technical Capabilities:

UAT-8099 demonstrates extensive control over compromised IIS environments through the combined use of web shells, PowerShell loaders, and the GotoHTTP remote access framework, enabling reliable command execution and long-term server management. To evade detection, the actor employs a mix of legitimate administrative utilities and red-team tools to remove event logs, hide malicious files, and disable security software. Persistence is reinforced through the creation of covert local user accounts and the use of VPN software such as SoftEther and EasyTier, allowing continued access even if primary web shells are discovered and removed.

BadIIS malware deployed by UAT-8099 exhibits advanced traffic inspection and response manipulation capabilities. The malware selectively hooks dynamic IIS pages and directory indexes, identifies search engine crawlers through request analysis, and issues conditional redirects to SEO fraud infrastructure. Region-specific variants further inspect HTTP headers, such as Accept-Language, to inject malicious JavaScript or tailored content for targeted users, while deliberately avoiding static resources and incompatible file types to minimize errors, reduce logging, and maintain operational stealth.

Attribution and Evolution:

Based on operational characteristics, infrastructure patterns, and tooling overlap, UAT-8099 is assessed to be a China-affiliated threat actor. Activity has been observed since at least April 2025 and shows strong similarities to the WEBJACK BadIIS campaign previously documented by WithSecure. The actor’s tradecraft has evolved from broad, opportunistic SEO fraud toward more selective, region-focused operations, incorporating increased use of legitimate red-team tools and adaptive persistence mechanisms in response to defensive detection.

Active Campaign and Geographic Spread:

The active campaign, observed from late 2025 through early 2026, targets IIS servers across Asia, with primary focus on Thailand and Vietnam. Additional activity has been detected in India, Pakistan, and Japan. Customized BadIIS variants tailored to regional languages and user behavior indicate deliberate victim selection rather than indiscriminate scanning. While the full scope of the campaign remains undetermined, observed infrastructure and tooling suggest coordinated and persistent operations.

Conclusion:

UAT-8099 represents a maturing threat actor specializing in the exploitation of IIS infrastructure for long-term, low-visibility operations. The combination of selective content manipulation, adaptive persistence, and geographic targeting underscores the need for improved IIS hardening, vigilant account monitoring, and behavioral detection focused on web-server abuse rather than traditional endpoint indicators.

Impact:

Compromised IIS servers are leveraged to conduct stealthy SEO poisoning, redirecting search engine crawlers and regional users to fraudulent or malicious content. This activity can damage website reputation, lead to search engine blacklisting, undermine site integrity, and expose visitors to additional malware. Persistent unauthorized access to production web servers further increases the risk of data exposure, lateral movement, and follow-on attacks beyond the initial SEO fraud objective.

IOC and Context Details:

‍

‍

Recommended Actions:

• Ensure all IIS servers and underlying Windows systems are fully patched and regularly updated to remediate known vulnerabilities.
• Audit and harden file upload functionality to prevent arbitrary file execution and unauthorized script deployment.
• Monitor for the creation of hidden or anomalous local user accounts, particularly accounts ending with special characters such as “$”.
• Implement logging and alerting for PowerShell and VBScript execution, as well as suspicious process activity on web servers.
• Restrict and monitor outbound network connections from IIS servers, especially VPN-related traffic and unknown external endpoints.
• Deploy web application firewalls and detection rules tailored to identify web shell activity and IIS response manipulation.
• Regularly review IIS directories and configuration settings for unauthorized files, scripts, or changes to response handling behavior.
• Establish incident response procedures for compromised web servers, including credential rotation, server reimaging, and forensic analysis.

Reference:

https://blog.talosintelligence.com/uat-8099-new-persistence-mechanisms-and-regional-focus/