UAT-8099 (China) BadIIS Malware Campaign Targeting IIS Servers for SEO Fraud — Threadlinqs Intelligence
As of 2026-05-30, UAT-8099 (China) BadIIS Malware Campaign Targeting IIS Servers for SEO Fraud is a high-severity apt threat attributed to UAT-8099 (China), tracked by Threadlinqs Intelligence with 33 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 100 indicators of compromise.
Threat ID: TL-2026-0007 · Severity: HIGH · CVSS: 8.1 · Status: ACTIVE · Category: APT
Attribution: UAT-8099 · China · FINANCIAL
UAT-8099 is a Chinese-speaking threat group tracked by Trend Micro that deploys BadIIS malware — native C++ IIS (Internet Information Services) modules — against Microsoft IIS web servers for SEO
UAT-8099 (Unattributed Threat-8099) is a Chinese-speaking advanced persistent threat group identified by Trend Micro that systematically compromises Microsoft Internet Information Services (IIS) web servers using BadIIS malware — a family of malicious native IIS modules. The campaign represents a significant evolution in server-side threats: rather than deploying traditional backdoors or web shells, the attackers install IIS native modules (C++ DLLs) that hook directly into the IIS HTTP request processing pipeline, giving them invisible, persistent access to all web traffic.
BadIIS malware implements the IIS C++ API, inheriting from CHttpModule or CGlobalModule classes and exporting the RegisterModule function. Once loaded by w3wp.exe (the IIS Worker Process), the malicious module intercepts every HTTP request at various pipeline stages — before authentication, during request processing, and during response generation. This architectural position gives BadIIS access to data in its unencrypted state, bypassing HTTPS protections entirely.
ESET's comprehensive research (Black Hat USA 2021) identified 14 distinct IIS malware families across 80+ unique samples, categorized into five operational modes: (1) IIS Backdoors for remote control, (2) IIS Infostealers for credential harvesting, (3) IIS Injectors for serving malicious content, (4) IIS Proxies for relaying C2 communications, and (5) SEO Fraud modules for search engine manipulation. BadIIS variants span multiple groups in ESET's taxonomy (Groups 1, 2, 3, 8, 9, 12), demonstrating its versatility.
UAT-8099's primary monetization is SEO fraud: BadIIS modules detect search engine crawler User-Agents (Googlebot, Bingbot, Baiduspider) and redirect them to Chinese gambling and pornography sites, artificially boosting those sites' search rankings. Legitimate users searching for compromised sites are also redirected. This operation generates revenue through affiliate programs with illicit gambling operators.
Initial access vectors include exploitation of Microsoft Exchange ProxyLogon (CVE-2021-26855/26857/26858/27065), ProxyShell (CVE-2021-34473/34523/31207), IIS-specific vulnerabilities like CVE-2023-36899 (ASP.NET elevation of privilege), and brute-force/credential stuffing against exposed IIS management interfaces. The campaign has been active since at least 2021 and targets government, telecommunications, education, and e-commerce organizations primarily in Asia-Pacific (India, Thailand, Vietnam, Philippines, Singapore, Japan, South Korea, Taiwan) and extending to Europe and Latin America.
Symantec documented a related IIS malware technique called Frebniis that hijacks the IIS Failed Request Event Buffering (FREB) feature — injecting malicious code into iisfreb.dll memory to intercept all HTTP requests without writing any files to disk. This represents the most stealthy variant of IIS malware: no files, no suspicious processes, purely in-memory operation.
The persistence mechanism is inherent to IIS architecture: native modules registered in IIS configuration are automatically loaded on every server restart. No additional persistence mechanisms are needed — the module survives reboots, updates, and process recycling. Detection requires inspecting IIS module registrations (applicationHost.config) for unauthorized DLLs.
Weaknesses (CWE)
CWE-502, CWE-918, CWE-287, CWE-269, CWE-94
Target sectors: Government, Education, Technology, Telecommunications, Healthcare, Manufacturing, Transportation, Media, Religious Organizations, Research Services
Target regions: India, Thailand, Vietnam, Philippines, Singapore, Taiwan, South Korea, Japan, Brazil, Bangladesh, Belgium, Netherlands
Detections & IOCs
As of 2026-07-27, this threat has 33 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 100 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, HIGH, threat intelligence, cybersecurity, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2021-34473, CVE-2021-34523, CVE-2021-31207, CVE-2023-36899, T1190, T1059, T1505, T1505, T1505, T1068, T1036, T1027, T1574, T1003