Cybersecurity researchers have uncovered a global SEO fraud network operated by a Chinese-speaking cybercrime group dubbed UAT-8099.
This group is primarily targeting Microsoft Internet Information Services (IIS) servers – particularly those vulnerable due to weak security settings or insecure upload features.
The group is using these servers to manipulate website rankings (SEO), artificially boost content visibility through backlinks, and then redirect traffic to illicit advertising or gambling websites.
How the Attack Works
The scope of this fraud network is vast, with infections reported in numerous countries, including India, Thailand, Vietnam, Canada, and Brazil.
For example, according to the researchers, the group first gains access to the server, then installs a web shell, upgrades guest accounts to administrator privileges, activates Remote Desktop Protocol (RDP), and maintains persistent control using VPNs or reverse proxy tools.
Global Impact
UAT-8099’s primary motivation is financial gain – namely, uncontrolled increases in website rankings, traffic manipulation, and advertising revenue. This type of fraud not only increases the risk of data theft or misuse on the targeted companies’ servers but also endangers internet users through malicious links or advertisements.
The researchers state that this type of attack specifically targets “accessible” servers – such as IIS servers used by universities, technology companies, and telecommunications service providers.
Security Measures
To mitigate against this type of cyber activity, the following recommendations are offered:
Regularly conduct security audits and apply IIS server updates.
Control unauthorized file uploads, limit the use of guest accounts, and adhere to the principle of least privilege. Monitor services such as RDP, VPN, and reverse proxies, and disable them if they are not needed.
Continuously monitor server logs and network activity, and immediately investigate any unusual redirects or backlinks being created.
Identify and analyze requests originating from web crawlers (such as Googlebot), and ensure that no unnecessary code is being injected into the responses.
The involvement of financially motivated cybercrime groups like UAT-8099 indicates that SEO fraud is no longer just a local issue; it is now being conducted on a global scale and targeting high-profile servers. Detecting and combating these types of activities has become more critical than ever for organizations.
Source: https://thehackernews.com
Frequently Asked Questions (FAQs)
UAT-8099 is a cybercrime group that primarily speaks Chinese. Cybersecurity experts have discovered that they are running a large-scale SEO fraud operation, which they carry out by compromising Microsoft IIS servers worldwide.
They search for IIS servers with weak security or poor upload settings, and then hack into them. After that, they install a web shell, gain administrator privileges, and enable RDP access. They maintain control over the server using a VPN or reverse proxy. Once they have control, they use these servers for search engine scams and send fake traffic wherever they want.
In this type of attack, the perpetrators deliberately manipulate search engine rankings. What is their motive? To push certain websites higher in search results, usually for financial gain. UAT-8099 achieves this by using compromised servers to create fake backlinks and redirect unsuspecting users to malicious gambling or low-quality advertising sites. All of this is done to profit from this manipulation.