Chinese Threat Actors Exploit High-Value IIS Servers to Manipulate Search Rankings

Cisco Talos warns that UAT-8099, a Chinese-speaking cybercriminal group, has been mass-scanning for and compromising misconfigured IIS servers across multiple countries since April 2025, deploying BadIIS web shells and Cobalt Strike to gain persistence, create/privilege-escalate accounts, dump credentials, exfiltrate sensitive data, and monetize access via SEO fraud that redirects search traffic to gambling and ad sites; Talos recommends patching IIS, restricting uploads, enforcing strong authentication and monitoring for web-shell and Cobalt Strike activity.