UAT-8099Threat actor
UAT-8099 is a Chinese-speaking cybercrime group primarily engaged in SEO fraud and the theft of high-value credentials, configuration files, and certificate data from vulnerable IIS servers. They utilize web shells and PowerShell to deploy the GotoHTTP tool for remote access, while also employing techniques such as DLL sideloading and RDP for persistence.From MISP Galaxy
Last reported 8 months ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 11 · each with the sentence it comes from- T1003.002Security Account Manager
“Security Account Manager (SAM) Registry Access”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Software Packing”
- T1027.002Software Packing
“Obfuscated Files or Information: Software Packing”
- T1036Masquerading
“During this attack, the threat actor stages three files masquerading within the System32\drivers folder:”
- T1136Create Account
“Create Account: Local Account”
- T1505Server Software Component
“Server Software Component: IIS Components”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
BADIIS to the Bone: New Insights to a Global SEO Poisoning Campaign“This activity corresponds with the threat group, UAT-8099, identified by Cisco Talos last October, and is consistent with prior reporting from Trend Micro”
Indicators in its reports
named in the reports above- gov[.]brin 1 report
- gov[.]inin 1 report
- 1e4b23eee1b96b0cc705da1e7fb9e2f3in 1 report
- hxxp://kr.gotz003[.]com/krfml/krfmlip.txtin 1 report
- kr.gotz003[.]comin 1 report
- hxxp://kr.gotz003[.]com/krfml/krfmltz.txtin 1 report
- hxxp://kr.gotz003[.]com/krfml/krfmllj.txtin 1 report
- hxxp://kr.gotz003[.]com/krfml/krfmldz.txtin 1 report
- b59ff1638e92ab1127b7bc76c7922245in 1 report
- tz123[.]appin 1 report
- hxxp://tz789[.]app/brfmljs.txtin 1 report
- tz789[.]appin 1 report
- gotz003[.]comin 1 report
- vn.gotz003[.]comin 1 report
- cn.gotz003[.]comin 1 report
- cnse.gotz003[.]comin 1 report
- bd.gotz003[.]comin 1 report
- jbtz003[.]comin 1 report
- br.jbtz003[.]comin 1 report
- vn.jbtz003[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.