UAT-8099 Exploits IIS Servers Using Web Shell Attacks

Cyberpress • January 30, 2026

A new campaign by the threat actor UAT-8099 is targeting vulnerable Internet Information Services (IIS) servers across Asia. Active from late 2025 ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

UAT-8099 Campaign Targets IIS Servers in Asia with Advanced Techniques Cisco Talos reports on the UAT-8099 campaign that has been targeting vulnerable IIS web servers across Asia since August 2025. Key affected regions include India, Pakistan, Thailand, Vietnam, and Japan, with a notable concentration in Thailand and Vietnam. The attackers utilize customized BadIIS variants, web shells, PowerShell, and the GotoHTTP tool for control, employing new persistence mechanisms such as hidden local accounts. 6 sources 27

Extracted Entities

Attack Types (2)

Malware Web Shell