IIS Servers Compromised by Chinese Hackers for SEO Manipulation

Cisco Talos has revealed that UAT-8099, a Chinese-speaking cybercrime group, has been exploiting vulnerable Internet Information Services (IIS) servers across multiple countries to conduct search engine optimization (SEO) fraud and steal high-value data.

Identified in April 2025, this group targets reputable IIS servers in India, Thailand, Vietnam, Canada, and Brazil, focusing on organizations such as universities, technology firms, and telecommunications providers.

Their main objective is to boost the search rankings of malicious sites and redirect legitimate traffic to unauthorized advertisements and illegal gambling platforms.

Campaign Overview

The UAT-8099 campaign begins with reconnaissance on unpatched IIS servers that allow unrestricted file uploads.

Once a vulnerability is found, the threat actors upload an open-source ASP.NET web shell to execute commands and gather system information.

This initial access allows them to create and elevate a guest user account to administrator privileges, enabling Remote Desktop Protocol (RDP) access.

The group then deploys web shells and uses open-source hacking tools alongside Cobalt Strike to establish and maintain persistence.

Cisco Talos uncovered several new BadIIS malware variants in this campaign, including clusters with minimal antivirus detection and those containing simplified Chinese debug messages.

After gaining initial access, UAT-8099 secures long-term control by enabling RDP, installing SoftEther VPN, using the EasyTier decentralized VPN tool, and setting up the FRP reverse proxy.

They escalate privileges with public tools, dump credentials using Procdump, and compress stolen data with WinRAR. To lock out other attackers, they install D_Safe_Manage, a known Windows IIS security tool.

The group’s automation scripts streamline tasks such as module installation, RDP configuration, and scheduled task creation for sideloading a Cobalt Strike beacon under the guise of a legitimate WMI code provider.

The layered defenses and customized scripts help them evade detection and maintain uninterrupted access to compromised servers.

SEO Manipulation and Impact

Once persistence is established, BadIIS malware is used to manipulate search engine crawlers and human visitors.

The OnBeginRequest handler checks HTTP headers for user-agent and referer values to determine whether to act as a proxy or inject malicious JavaScript.

When Googlebot is detected, the malware serves crafted content or backlinks to inflate search rankings. For human users referred from search engines, it injects JavaScript that redirects browsers to gambling or advertisement sites.

The OnSendResponse handler further enhances fraud by delivering SEO-focused content specifically designed for crawlers, followed by targeted redirects for users encountering error pages.

By compromising multiple IIS servers worldwide, UAT-8099 creates a network of high-reputation sites that collectively boost the visibility of their malicious destinations.

Mobile users on Android and iOS devices are particularly affected, as compromised servers serve tailored APK and iOS app download pages.

Cisco Talos continues to monitor this campaign, urging organizations to secure their IIS servers by applying the latest patches, restricting file upload types, enforcing strong account policies, and deploying robust monitoring solutions.

Failure to address these vulnerabilities not only risks operational disruption but also facilitates large-scale SEO fraud and credential theft.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.