# UAT-8099 (China) BadIIS Malware Campaign Targeting IIS Servers for SEO Fraud

> UAT-8099 is a Chinese-speaking threat group tracked by Trend Micro that deploys BadIIS malware — native C++ IIS (Internet Information Services) modules — against Microsoft IIS web servers for SEO fraud, traffic redirection, credential theft, and backdoor access. BadIIS malware operates as malicious IIS extensions (DLLs) loaded by the IIS Worker Process (w3wp.exe), giving it unrestricted access to all HTTP requests processed by the server in their unencrypted state. The campaign targets IIS servers across Asia-Pacific, India, and globally, exploiting unpatched IIS/Exchange vulnerabilities (ProxyLogon, ProxyShell, CVE-2023-36899) or leveraging stolen credentials for initial access. Once installed, BadIIS modules intercept all HTTP traffic, enabling passive C2 communication, SEO manipulation via injected redirects to Chinese gambling/pornography sites, credential harvesting from login forms, and proxy functionality for other malware operations. ESET documented 14 IIS malware families across 80+ samples at Black Hat USA 2021, with BadIIS being the most prevalent. The financially-motivated SEO fraud campaign generates revenue by redirecting search engine crawlers and users to illicit gambling operations — turning compromised web servers into invisible SEO fraud infrastructure.

- **Published:** 2026-02-02T18:00:00Z
- **Last reviewed:** 2026-02-02T18:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0007
- **ID:** TL-2026-0007
- **Severity:** HIGH (CVSS 8.1)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** UAT-8099 (China)
- **Detections:** 33 · **IOCs:** 100 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2021-34473, CVE-2021-34523, CVE-2021-31207, CVE-2023-36899

## Description

UAT-8099 (Unattributed Threat-8099) is a Chinese-speaking advanced persistent threat group identified by Trend Micro that systematically compromises Microsoft Internet Information Services (IIS) web servers using BadIIS malware — a family of malicious native IIS modules. The campaign represents a significant evolution in server-side threats: rather than deploying traditional backdoors or web shells, the attackers install IIS native modules (C++ DLLs) that hook directly into the IIS HTTP request processing pipeline, giving them invisible, persistent access to all web traffic.

BadIIS malware implements the IIS C++ API, inheriting from CHttpModule or CGlobalModule classes and exporting the RegisterModule function. Once loaded by w3wp.exe (the IIS Worker Process), the malicious module intercepts every HTTP request at various pipeline stages — before authentication, during request processing, and during response generation. This architectural position gives BadIIS access to data in its unencrypted state, bypassing HTTPS protections entirely.

ESET's comprehensive research (Black Hat USA 2021) identified 14 distinct IIS malware families across 80+ unique samples, categorized into five operational modes: (1) IIS Backdoors for remote control, (2) IIS Infostealers for credential harvesting, (3) IIS Injectors for serving malicious content, (4) IIS Proxies for relaying C2 communications, and (5) SEO Fraud modules for search engine manipulation. BadIIS variants span multiple groups in ESET's taxonomy (Groups 1, 2, 3, 8, 9, 12), demonstrating its versatility.

UAT-8099's primary monetization is SEO fraud: BadIIS modules detect search engine crawler User-Agents (Googlebot, Bingbot, Baiduspider) and redirect them to Chinese gambling and pornography sites, artificially boosting those sites' search rankings. Legitimate users searching for compromised sites are also redirected. This operation generates revenue through affiliate programs with illicit gambling operators.

Initial access vectors include exploitation of Microsoft Exchange ProxyLogon (CVE-2021-26855/26857/26858/27065), ProxyShell (CVE-2021-34473/34523/31207), IIS-specific vulnerabilities like CVE-2023-36899 (ASP.NET elevation of privilege), and brute-force/credential stuffing against exposed IIS management interfaces. The campaign has been active since at least 2021 and targets government, telecommunications, education, and e-commerce organizations primarily in Asia-Pacific (India, Thailand, Vietnam, Philippines, Singapore, Japan, South Korea, Taiwan) and extending to Europe and Latin America.

Symantec documented a related IIS malware technique called Frebniis that hijacks the IIS Failed Request Event Buffering (FREB) feature — injecting malicious code into iisfreb.dll memory to intercept all HTTP requests without writing any files to disk. This represents the most stealthy variant of IIS malware: no files, no suspicious processes, purely in-memory operation.

The persistence mechanism is inherent to IIS architecture: native modules registered in IIS configuration are automatically loaded on every server restart. No additional persistence mechanisms are needed — the module survives reboots, updates, and process recycling. Detection requires inspecting IIS module registrations (applicationHost.config) for unauthorized DLLs.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1574 Hijack Execution Flow
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1049 System Network Connections Discovery
- T1057 Process Discovery
- T1069 Permission Groups Discovery
- T1033 System Owner/User Discovery
- T1016 System Network Configuration Discovery
- T1021 Remote Services
- T1213 Data from Information Repositories
- T1071 Application Layer Protocol
- T1132 Data Encoding
- T1491 Defacement
- T1595 Active Scanning
- T1203 Exploitation for Client Execution
- T1106 Native API
- T1129 Shared Modules
- T1070 Indicator Removal
- T1055 Process Injection
- T1553 Subvert Trust Controls
- T1140 Deobfuscate/Decode Files or Information
- T1056 Input Capture
- T1552 Unsecured Credentials
- T1040 Network Sniffing
- T1539 Steal Web Session Cookie
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1185 Browser Session Hijacking
- T1119 Automated Collection
- T1090 Proxy
- T1573 Encrypted Channel
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1565 Data Manipulation

## Sources

- [Trend Micro — Chinese-Speaking Group Manipulates SEO with BadIIS](https://www.trendmicro.com/en_us/research/25/b/chinese-speaking-group-manipulates-seo-with-badiis.html)
- [Trend Micro — BadIIS Campaign IOCs (70+ hashes, 60+ domains, 6 IPs)](https://documents.trendmicro.com/assets/txt/badiis-IOCspbJhGdi.txt)
- [Cisco Talos — DragonRank SEO manipulator service provider](https://blog.talosintelligence.com/dragon-rank-seo-poisoning/)
- [ESET / Black Hat USA 2021 — Anatomy of Native IIS Malware](https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Anatomy-Of-Native-Iis-Malware-wp.pdf)
- [AhnLab ASEC — BadIIS targeting Korean IIS servers](https://asec.ahnlab.com/jp/65289/)
- [The Hacker News — China-Linked Attackers Deploy ShadowPad and NailaoLocker (related tooling)](https://thehackernews.com/2025/02/chinese-linked-attackers-exploit-check.html)
- [Trend Micro — Updated ShadowPad Leads to Ransomware Deployment](https://www.trendmicro.com/en_us/research/25/b/updated-shadowpad-malware-leads-to-ransomware-deployment.html)
- [Microsoft — IIS Security Best Practices](https://learn.microsoft.com/en-us/iis/get-started/planning-for-security/)
- [ESET: Anatomy of native IIS malware (Black Hat USA 2021)](https://www.welivesecurity.com/2021/08/06/anatomy-native-iis-malware/)
- [ESET: BadIIS YARA Rules and IOCs (GitHub)](https://github.com/eset/malware-ioc/tree/master/badiis)
- [Symantec: Frebniis — IIS FREB Feature Hijacking Backdoor](https://www.security.com/threat-intelligence/frebniis-malware-iis)
- [Trend Micro: UAT-8099 Targets IIS Servers with BadIIS](https://www.trendmicro.com/en_us/research/25/a/uat-8099-targets-iis-servers-badiis.html)
- [ESET: IIStealer — e-commerce credential theft via IIS](https://www.welivesecurity.com/2021/08/06/iistealer-server-side-threat-ecommerce-transactions/)
- [ESET: IISpy — IIS backdoor with anti-forensic features](https://www.welivesecurity.com/2021/08/09/iispy-complex-server-side-backdoor-antiforensic-features/)
- [ESET: IISerpent — SEO fraud via IIS malware](https://www.welivesecurity.com/2021/08/11/iiserpent-malware-driven-seo-fraud-service/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0007