A Chinese-speaking cybercrime group, tracked as UAT-10147, targeting vulnerable Windows and Linux web servers worldwide to deploy BadIIS malware, steal data, and manipulate search engine results for financial gain.
Talos observed victims in Brazil, Bolivia, China, Canada, and Vietnam, spanning government, education, media, technology, and gaming organizations.
An operational security lapse exposed an attacker download server at 139.180.197[.]150, where researchers found an open directory and a target list of roughly 170,000 URLs.
The group divided the list into 17 files of about 10,000 URLs each, indicating an organized, high-volume approach to identifying and exploiting internet-facing infrastructure.
Initial access relies primarily on exploitation of publicly disclosed remote-code-execution flaws.
Talos linked the activity to exploitation of Zimbra CVE-2022-27925, AjaxPro CVE-2021-23758, Nacos CVE-2021-29441 and CVE-2021-29442, and Telerik UI for ASP.NET AJAX CVE-2019-18935.
The Nacos exploitation activity is particularly notable because it can collect basic host telemetry and send it to an attacker-controlled Nacos configuration service, allowing the operators to validate successful compromise without maintaining a noisy interactive shell.
Cisco Talos Researchers said that, the campaign marks a notable evolution in criminal web-server operations: the actor combines publicly known vulnerabilities with AI-assisted exploit development, validation, reconnaissance, and persistence.
UAT-10147 Compromises Web Servers
On Windows IIS servers, UAT-10147 commonly executes staged batch scripts following remote code execution. The scripts use certutil to retrieve payloads, including EfsPotato for privilege escalation and QuasarRAT disguised as svchosts.exe.
After elevating privileges, the operators add System32inetsrv and SysWOW64inetsrv to Microsoft Defender exclusion paths through PowerShell and Registry changes, creating a blind spot around the IIS directories where BadIIS modules are deployed.
The group then enumerates IIS sites through appcmd, likely to identify the most valuable injection points, and can establish long-term access by creating rogue local users with Administrator and Remote Desktop Users group membership.
Talos also observed scheduled-task persistence masquerading as “Google Chrome Start,” configured to launch malware with highest privileges at user logon.
On Linux, the group deploys web shells after exploiting vulnerable applications, then attempts local privilege escalation using a broad collection of known flaws, including Dirty Pipe (CVE-2022-0847), Baron Samedit (CVE-2021-3156), and CVE-2022-0995.
Root-level access enables deployment of implants such as NoodleRAT, Meterpreter, and SPECTRE, a cross-platform backdoor that Talos says supports command-and-control, credential theft, process injection, anti-analysis functions, and Linux rootkit or BYOVD-oriented capabilities.
BadIIS is central to the operation’s monetization model. The IIS-focused malware can redirect traffic, manipulate crawler responses, hijack content, inject backlinks, and use reverse-proxy capabilities to influence search rankings and funnel users toward illicit destinations.
Talos has previously assessed some BadIIS variants as commodity malware offered or shared among Chinese-speaking criminal actors, supported by configurable builders that streamline SEO-fraud deployments.
What distinguishes UAT-10147 is its use of agentic AI tooling.
Talos found AI-generated playbooks and Python automation that refined exploits, checked file-system permissions, validated ViewState remote code execution through out-of-band callbacks, deployed implants, and created web shells.
The actor also used tools including Metasploit, ysoserial, PentestGPT, and DeepAudit, reducing the manual effort typically associated with post-exploitation and enabling repeatable intrusions at scale.
For defenders, the campaign reinforces the need to patch exposed web applications quickly, audit IIS modules and Defender exclusions, investigate unexpected scheduled tasks and privileged local accounts, and closely monitor certutil, PowerShell, appcmd, and suspicious outbound callbacks.
Organizations should also review web-server logs for exploitation attempts against the identified CVEs and hunt for unauthorized ASHX handlers, altered IIS configurations, and abnormal search-engine crawler behavior.
★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide
