Cyber Sleuth Ting's Juicy Scoop: Chinese Hackers Gone Wild in SEO Fraud Frenzy

This is your Digital Frontline: Daily China Cyber Intel podcast. It’s your favorite cyber sleuth Ting, back again with a fresh byte of Digital Frontline: Daily China Cyber Intel, and trust me, if you’re betting digital fortresses can hold while you nap, it’s time to toss those dice again. Let’s rip into the latest from the past 24 hours—where Chinese cyber operators are pulling new tricks from both the crime and espionage playbooks. Front and center today: Cisco Talos just dropped a bombshell on UAT-8099—a Chinese-speaking cybercrime group that’s chewing through vulnerable Microsoft Internet Information Services servers like your nephew chews through Halloween candy. Their play? Not just stealing high-value data but running a massive SEO fraud racket. These cyber ninjas are going after universities, telecoms, and tech companies from India to Canada, hijacking well-reputed servers to bump up the rankings of their scam sites. Imagine surfing your university homepage and ending up on “Lucky Money Slots” or some illegal gambling den—no, it’s not fun, it’s business for UAT-8099. Here’s the technical part, so buckle up. UAT-8099 crawls the internet using automation to find weak IIS servers—those with unrestricted file upload holes. Once inside, they plant nifty ASP.NET web shells, get admin rights, and slither in for RDP remote access. Their toolkit? Cobalt Strike for persistence and a collection of new BadIIS malware samples—one cluster flies so far under antivirus radars it might as well be in stealth mode. What’s spicy this cycle is their automation: scripts that mass-install modules, configure RDP, and blend in as legitimate system processes. When Googlebot—a search crawler—knocks, these infected servers serve up SEO-poisoned content, pushing up the visibility of shady destinations. For human users, you get redirected to dubious sites or served up mobile malware tailored for your phone. The BadIIS plugin is like a Swiss Army knife for SEO fraud—the on-begin-request handler distinguishes between bots and humans, slipping past crawlers with custom content and shuffling people to adverts and gambling if they’re real. It’s so slick, most users and even some sysadmins don’t realize what hit them. While the black hats feast, the red teams are restless too. Chinese state-backed group RedNovember, according to Ampcus Cyber, is poking at edge devices in defense, aerospace, and high-tech sectors. Their targets stretch from Houston’s energy grids to Silicon Valley’s R&D labs. If your organization has anything that connects to the internet—even that dusty router in the mailroom—it’s a juicy entry point. And don’t sleep on telecom routers either; Salt Typhoon, another Mandarin-speaking actor, is worming into backbone comms providers. Once they’ve burrowed in, these folks can ride under the radar for months, sometimes years, siphoning emails, credentials, or even hijacking SMS routes. Expert analysis is unanimous: now is not the time to skip those patches o This content was created in partnership and with the help of Artificial Intelligence AI.