Cisco Talos reports a fresh UAT-8099 campaign targeting vulnerable IIS web servers across Asia. The actor deploys customized BadIIS variants that include regional identifiers and relies on web shells, PowerShell, and the GotoHTTP remote control tool for follow-on control. Persistence has expanded to include creation of hidden local accounts and the use of legitimate red-team utilities to blend into administrative activity. The tradecraft overlaps with the earlier WEBJACK operation and appears focused on SEO fraud impacting sites in Thailand and Vietnam.
Talos reviewed DNS telemetry, file hashes, and malicious scripts to reconstruct the intrusion chain. Analysts observed web shells combined with tooling such as SoftEther VPN and EasyTier, plus a set of bespoke utilities including Sharp4RemoveLog, CnCrypt Protect, OpenArk64, and GotoHTTP. Two region-tuned BadIIS strains—IISHijack and asdSearchEngine—were reverse engineered, exposing hard-coded country codes, selective request filtering, and XOR-encrypted C2 configuration. An ELF build of BadIIS with matching C2 domains was also identified on VirusTotal.
Patch exposed IIS vulnerabilities, strengthen web application firewall enforcement, and monitor for creation of hidden local accounts (for example, admin$, mysql$, and similar). Detect PowerShell activity that downloads or launches GotoHTTP and block outbound communication to known C2 domains. Use endpoint controls to alert on execution of the identified custom utilities and on unexpected modifications within web server directories.
If indicators are found, isolate the server, remove web shells, and delete hidden accounts. Preserve BadIIS binaries and related scripts for forensic analysis, and perform full network-traffic review to identify C2 activity. Restore from a known-good backup and re-harden IIS configuration to prevent reinfection.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Attack Narrative & Commands: An attacker has gained initial foothold on a compromised web server. They create a hidden directory called bad_iis under the IIS web root and drop a custom‑named web‑shell binary shell_xyz.exe (avoiding the literal string “web shell”). Using the shell, they laterally execute a PowerShell payload that downloads the GotoHTTP binary, renames it to svc_update.exe , and runs it. Because the image names are obfuscated, the original rule’s Image|contains checks are bypassed, while the command line still contains “PowerShell”.
Regression Test Script: This script reproduces the described steps and generates telemetry similar to the BadIIS attack without using the exact strings the rule watches for.
Cleanup Commands: Removes the planted artifacts and restores the environment.
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
