UAT-8099 (China) BadIIS Malware Campaign Targeting IIS Servers for SEO Fraud

UAT-8099 (China) BadIIS Malware Campaign Targeting IIS (TL-2026-0007), also tracked as UAT-8099, is a high-severity advanced persistent threat campaign scored CVSS 8.1, first published 2026-02-02. It is attributed to UAT-8099 (China) with high confidence, affects Microsoft Internet Information Services (IIS), references 8 CVEs (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858), maps to 51 MITRE ATT&CK techniques (T1003, T1005, T1016), and is covered by 33 detection rules and 100 indicators of compromise.

Key facts for TL-2026-0007

Threat ID
TL-2026-0007
Also known as
UAT-8099, BadIIS, WEBJACK
Severity
HIGH
CVSS
8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Status
ACTIVE
Category
APT
First published
2026-02-02
Last reviewed
2026-02-02
Attribution
UAT-8099
Attribution confidence
HIGH
Nation-state nexus
China
Motivation
FINANCIAL
Target sectors
Government, Education, Technology, Telecommunications, Healthcare, Manufacturing, Transportation, Media, Religious Organizations, Research Services
Target regions
India, Thailand, Vietnam, Philippines, Singapore, Taiwan, South Korea, Japan, Brazil, Bangladesh, Belgium, Netherlands
Detection rules
33
Indicators of compromise
100

Malware and tooling in UAT-8099 (China) BadIIS Malware Campaign Targeting IIS

Malware and tooling: ASPXspy at C:\phpMyAdmin\shell.aspx, ASPXspy web shell at C:\phpMyAdmin\shell.aspx or C:\AWStats\wwwroot\shell.aspx

UAT-8099 is a Chinese-speaking threat group tracked by Trend Micro that deploys BadIIS malware — native C++ IIS (Internet Information Services) modules — against Microsoft IIS web servers for SEO fraud, traffic redirection, credential theft, and backdoor access. BadIIS malware operates as malicious IIS extensions (DLLs) loaded by the IIS Worker Process (w3wp.exe), giving it unrestricted access to all HTTP requests processed by the server in their unencrypted state. The campaign targets IIS servers across Asia-Pacific, India, and globally, exploiting unpatched IIS/Exchange vulnerabilities (ProxyLogon, ProxyShell, CVE-2023-36899) or leveraging stolen credentials for initial access. Once installed, BadIIS modules intercept all HTTP traffic, enabling passive C2 communication, SEO manipulation via injected redirects to Chinese gambling/pornography sites, credential harvesting from login forms, and proxy functionality for other malware operations. ESET documented 14 IIS malware families across 80+ samples at Black Hat USA 2021, with BadIIS being the most prevalent. The financially-motivated SEO fraud campaign generates revenue by redirecting search engine crawlers and users to illicit gambling operations — turning compromised web servers into invisible SEO fraud infrastructure.

How UAT-8099 (China) BadIIS Malware Campaign Targeting IIS works

UAT-8099 (Unattributed Threat-8099) is a Chinese-speaking advanced persistent threat group identified by Trend Micro that systematically compromises Microsoft Internet Information Services (IIS) web servers using BadIIS malware — a family of malicious native IIS modules. The campaign represents a significant evolution in server-side threats: rather than deploying traditional backdoors or web shells, the attackers install IIS native modules (C++ DLLs) that hook directly into the IIS HTTP request processing pipeline, giving them invisible, persistent access to all web traffic.

BadIIS malware implements the IIS C++ API, inheriting from CHttpModule or CGlobalModule classes and exporting the RegisterModule function. Once loaded by w3wp.exe (the IIS Worker Process), the malicious module intercepts every HTTP request at various pipeline stages — before authentication, during request processing, and during response generation. This architectural position gives BadIIS access to data in its unencrypted state, bypassing HTTPS protections entirely.

ESET's comprehensive research (Black Hat USA 2021) identified 14 distinct IIS malware families across 80+ unique samples, categorized into five operational modes: (1) IIS Backdoors for remote control, (2) IIS Infostealers for credential harvesting, (3) IIS Injectors for serving malicious content, (4) IIS Proxies for relaying C2 communications, and (5) SEO Fraud modules for search engine manipulation. BadIIS variants span multiple groups in ESET's taxonomy (Groups 1, 2, 3, 8, 9, 12), demonstrating its versatility.

UAT-8099's primary monetization is SEO fraud: BadIIS modules detect search engine crawler User-Agents (Googlebot, Bingbot, Baiduspider) and redirect them to Chinese gambling and pornography sites, artificially boosting those sites' search rankings. Legitimate users searching for compromised sites are also redirected. This operation generates revenue through affiliate programs with illicit gambling operators.

Initial access vectors include exploitation of Microsoft Exchange ProxyLogon (CVE-2021-26855/26857/26858/27065), ProxyShell (CVE-2021-34473/34523/31207), IIS-specific vulnerabilities like CVE-2023-36899 (ASP.NET elevation of privilege), and brute-force/credential stuffing against exposed IIS management interfaces. The campaign has been active since at least 2021 and targets government, telecommunications, education, and e-commerce organizations primarily in Asia-Pacific (India, Thailand, Vietnam, Philippines, Singapore, Japan, South Korea, Taiwan) and extending to Europe and Latin America.

Symantec documented a related IIS malware technique called Frebniis that hijacks the IIS Failed Request Event Buffering (FREB) feature — injecting malicious code into iisfreb.dll memory to intercept all HTTP requests without writing any files to disk. This represents the most stealthy variant of IIS malware: no files, no suspicious processes, purely in-memory operation.

The persistence mechanism is inherent to IIS architecture: native modules registered in IIS configuration are automatically loaded on every server restart. No additional persistence mechanisms are needed — the module survives reboots, updates, and process recycling. Detection requires inspecting IIS module registrations (applicationHost.config) for unauthorized DLLs.

MITRE ATT&CK techniques used in TL-2026-0007

credential-access

T1003 OS Credential Dumping; T1040 Network Sniffing; T1110 Brute Force; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials

collection

T1005 Data from Local System; T1056 Input Capture; T1074 Data Staged; T1119 Automated Collection; T1185 Browser Session Hijacking; T1213 Data from Information Repositories

discovery

T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1046 Network Service Discovery; T1049 System Network Connections Discovery; T1057 Process Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery

lateral-movement

T1021 Remote Services; T1210 Exploitation of Remote Services

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1070 Indicator Removal; T1078 Valid Accounts; T1140 Deobfuscate/Decode Files or Information

exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1129 Shared Modules; T1203 Exploitation for Client Execution

privilege-escalation

T1068 Exploitation for Privilege Escalation; T1546 Event Triggered Execution

command-and-control

T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1132 Data Encoding; T1573 Encrypted Channel

defense-impairment

T1112 Modify Registry; T1553 Subvert Trust Controls

initial-access

T1190 Exploit Public-Facing Application

impact

T1491 Defacement; T1565 Data Manipulation

persistence

T1505 Server Software Component; T1574 Hijack Execution Flow

resource-development

T1583 Acquire Infrastructure; T1587 Develop Capabilities

reconnaissance

T1595 Active Scanning

Affected products and versions in UAT-8099 (China) BadIIS Malware Campaign Targeting IIS

  • Microsoft — Internet Information Services (IIS)
    Vulnerable versions: 7.0; 7.5; 8.0; 8.5; 10.0
  • Microsoft — Windows Server
    Vulnerable versions: 2008 R2; 2012; 2012 R2; 2016; 2019; 2022
  • Microsoft — Exchange Server
    Vulnerable versions: 2013; 2016; 2019
    Fixed in: 2013 CU23 Mar 2021; 2016 CU19/CU20 Mar 2021; 2019 CU8/CU9 Mar 2021
  • Microsoft — ASP.NET Core
    Vulnerable versions: All versions before Aug 2023 patches
    Fixed in: Aug 2023 Security Update

Remediation for UAT-8099 (China) BadIIS Malware Campaign Targeting IIS

Patches

  • Microsoft Exchange: Install latest Cumulative Update + Security Updates (ProxyLogon: March 2021, ProxyShell: April/May 2021)
  • Microsoft IIS/ASP.NET: August 2023 security update (CVE-2023-36899)
  • Windows Server: Apply all current security patches

Immediate actions

  • Audit IIS native module registrations: review %windir%\system32\inetsrv\config\applicationHost.config for unauthorized globalModules and modules entries
  • Check for unsigned or unknown DLLs in IIS module directories: %windir%\system32\inetsrv\ and application-specific bin directories
  • Run ESET YARA rules from github.com/eset/malware-ioc/tree/master/badiis against all IIS module DLLs
  • Verify digital signatures on all loaded IIS native modules — legitimate modules are signed by Microsoft or the vendor
  • Patch Microsoft Exchange to latest CU — eliminates ProxyLogon and ProxyShell initial access vectors
  • Patch IIS and ASP.NET to address CVE-2023-36899 and other privilege escalation vulnerabilities

Workarounds

  • If patching is delayed: restrict IIS management access to trusted admin workstations only
  • Disable OWA if not required — reduces Exchange/IIS attack surface
  • Block known BadIIS C2 header patterns at WAF/reverse proxy level
  • Monitor IIS module registrations via scheduled task comparing against known-good baseline

Longer-term hardening

  • Implement application whitelisting for IIS module directories — only allow signed, approved DLLs
  • Deploy EDR monitoring on IIS servers with alerting for w3wp.exe spawning unexpected child processes
  • Enable IIS request logging with full headers and monitor for C2 communication patterns (custom headers, encoded bodies)
  • Segment IIS servers in dedicated network zones with restricted outbound access
  • Implement regular integrity monitoring of applicationHost.config and IIS module registrations
  • Deploy WAF rules to detect and block known BadIIS C2 header patterns

CVEs associated with UAT-8099 (China) BadIIS Malware Campaign Targeting IIS

CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2021-34473, CVE-2021-34523, CVE-2021-31207, CVE-2023-36899

Weaknesses (CWE) in UAT-8099 (China) BadIIS Malware Campaign Targeting IIS

CWE-502, CWE-918, CWE-287, CWE-269, CWE-94

Timeline of UAT-8099 (China) BadIIS Malware Campaign Targeting IIS

Showing the 20 most recent tracked events.

  • ESET detects 5 distinct IIS backdoor campaigns spread via ProxyLogon between March-June 2021. Internet-wide scans identify additional victims. Source: ESET Black Hat USA 2021 paper.
  • Microsoft patches ProxyShell (CVE-2021-34473/34523/31207) — another Exchange pre-auth RCE chain. Widely exploited for IIS malware deployment. Source: https://nvd.nist.gov/vuln/detail/CVE-2021-34473
  • ESET presents 'Anatomy of native IIS malware' at Black Hat USA 2021 — documents 14 IIS malware families, 80+ samples, including BadIIS. First comprehensive public taxonomy of server-side IIS threats. Source: https://www.blackhat.com/us-21/briefings/schedule/#anatomy-of-native-iis-malware-23395
  • ESET researchers present 'Anatomy of Native IIS Malware' at Black Hat USA 2021, documenting 14 families of IIS backdoors including Group 11 (predecessor of current BadIIS variant). Establishes IIS native module malware as a distinct threat category. Source: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Anatomy-Of-Native-Iis-Malware-wp.pdf
  • ESET documents IIStealer — IIS malware specifically targeting e-commerce checkout pages to steal credit card data. Monitors /checkout/checkout.aspx and /checkout/Payment.aspx. Source: https://www.welivesecurity.com/2021/08/06/iistealer-server-side-threat-ecommerce-transactions/
  • ESET publishes full white paper and YARA rules for 14 IIS malware families. BadIIS categorized across Groups 1-14 with distinct detection signatures. Source: https://www.welivesecurity.com/2021/08/06/anatomy-native-iis-malware/
  • ESET documents IISpy — sophisticated IIS backdoor with anti-forensic features including AES-CBC encrypted C2 and anti-logging capabilities. Source: https://www.welivesecurity.com/2021/08/09/iispy-complex-server-side-backdoor-antiforensic-features/
  • ESET documents IISerpent — IIS malware providing SEO fraud as a service. Redirects search engine crawlers to boost rankings of illicit sites. Source: https://www.welivesecurity.com/2021/08/11/iiserpent-malware-driven-seo-fraud-service/
  • Symantec discovers Frebniis — novel IIS malware that hijacks Failed Request Event Buffering (FREB) feature by injecting code into iisfreb.dll memory. Fileless, stealthy IIS backdoor targeting Taiwan. Source: https://www.security.com/threat-intelligence/frebniis-malware-iis
  • Microsoft patches CVE-2023-36899 — ASP.NET elevation of privilege vulnerability exploitable for IIS module installation. Source: https://nvd.nist.gov/vuln/detail/CVE-2023-36899
  • UAT-8099 campaign escalates with mass targeting of IIS servers across Asia-Pacific. SEO fraud redirections to Chinese gambling sites observed at scale. Source: Trend Micro internal tracking.
  • AhnLab ASEC reports BadIIS campaign targeting Korean IIS servers. First documented regional impact in South Korea. Source: https://asec.ahnlab.com/jp/65289/
  • Cisco Talos discloses DragonRank campaign — Chinese-speaking SEO manipulation service deploying PlugX and BadIIS on 35+ compromised IIS servers across Thailand, India, Korea, Belgium, Netherlands, China. Identifies commercial operator '天天推工作室'. Source: https://blog.talosintelligence.com/dragon-rank-seo-poisoning/
  • BadIIS campaign expands to additional Asian targets: Philippines, Singapore, Taiwan, Vietnam, Bangladesh. Government, university, and telecom servers compromised. Trend Micro begins tracking as UAT-8099.
  • BadIIS campaigns continue through 2025-2026 with new variants. IIS malware remains an underdetected threat class due to server-side operation and legitimate IIS extension architecture. Source: ESET and Trend Micro ongoing monitoring.
  • Trend Micro publishes research on UAT-8099 — Chinese-speaking group targeting IIS servers with BadIIS malware for SEO fraud and traffic redirection across Asia-Pacific, India, and globally. Source: Trend Micro research.
  • Trend Micro publishes comprehensive analysis of BadIIS campaign. Documents 70+ malware samples (Win32/Win64), 60+ C2 domains, 6 C2 IPs. Identifies two operational modes: SEO fraud and injector. New variant uses OnSendResponse handler (evolved from Group 11's OnBeginRequest). Source: https://www.trendmicro.com/en_us/research/25/b/chinese-speaking-group-manipulates-seo-with-badiis.html
  • Trend Micro and Orange Cyberdefense document updated ShadowPad malware deployment via similar DLL side-loading techniques, linked to Chinese APT groups (Teleboyi). NailaoLocker ransomware deployed on healthcare targets in Europe. Demonstrates shared tooling across Chinese threat clusters. Source: https://thehackernews.com/2025/02/chinese-linked-attackers-exploit-check.html
  • Campaign continues actively. New BadIIS variants detected in the wild. Organizations in Asia and expanding to Europe remain primary targets. No indication of cessation.
  • As of 2026-05-29, UAT-8099's BadIIS SEO-fraud campaign remains active and expanding, with Cisco Talos (Jan 29 2026) and Elastic Security Labs (Feb 11 2026) documenting 1,800+ compromised IIS servers, new region-specific variants (IISHijack/asdSearchEngine), a Linux ELF build, and new persistence. No takedown, arrests, or actor disruption have been reported; the underlying initial-access CVEs are patched but the actor is the live threat.

Sources cited for UAT-8099 (China) BadIIS Malware Campaign Targeting IIS

Threats related to UAT-8099 (China) BadIIS Malware Campaign Targeting IIS

Detection coverage for TL-2026-0007

As of 2026-02-02, Threadlinqs Intelligence publishes 33 detection rule(s) for TL-2026-0007 across Splunk SPL, Microsoft KQL and Sigma, covering 100 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats