Back Cybersecuritynews

UAT-8099 Targets Vulnerable IIS Servers Using Web Shells, PowerShell, and Region

Cybersecuritynews •Tushar Subhra Dutta • January 30, 2026

A new wave of targeted attacks has emerged against Internet Information Services (IIS) servers across Asia, with threat actors deploying sophisticated malware designed to compromise vulnerable systems. The campaign, active from late 2025 through early 2026, focuses primarily on victims in Thailand and Vietnam, marking a strategic shift toward region-specific operations. The attackers exploit unpatched […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

UAT-8099 Campaign Targets IIS Servers in Asia with Advanced Techniques Cisco Talos reports on the UAT-8099 campaign that has been targeting vulnerable IIS web servers across Asia since August 2025. Key affected regions include India, Pakistan, Thailand, Vietnam, and Japan, with a notable concentration in Thailand and Vietnam. The attackers utilize customized BadIIS variants, web shells, PowerShell, and the GotoHTTP tool for control, employing new persistence mechanisms such as hidden local accounts. 6 sources 27

Extracted Entities

UAT-8099 Targets Vulnerable IIS Servers Using Web Shells, PowerShell, and Region

The full story

Extracted Entities

Attack Types (2)

Countries (2)

MITRE ATT&CK (1)

Tools (1)