Everything

Researchers say Chinese-speaking group UAT-8099 uses IIS servers for global SEO fraud

Cybercrime, Research, Risk, Vulnerabilities

October 6, 2025

Researchers say a Chinese-speaking group dubbed UAT-8099 has been exploiting Microsoft IIS servers to run SEO fraud and steal credentials and certificate data, using web shells, Cobalt Strike and a modified BadIIS backdoor across targets in Asia and the Americas.