← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud
WHITE UAT-8099 Tr1sa111 2025-10-06 Modified: 2025-11-01
80
IOCs
HIGH VOLUME
chinese-speakingweb shellsdata theftseo fraudbadiiscybercrimeiis serverscobalt strike
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
Indicators of Compromise (3 / 80 total)
All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 domain hostname
TYPEINDICATORDESCRIPTIONCREATED
FileHash-SHA1 085bdd7a4b4e69a1bf7fbe50b15187c64be52763 — 2025-10-06
FileHash-SHA1 c12024f2444daeca42ebb6dbd428317bced6ef8d — 2025-10-06
FileHash-SHA1 f18a6fa421469a6041b080ba992080cd83fbcdd5 — 2025-10-06
References (2)
↗ https://blog.talosintelligence.com/uat-8099-chinese-speaking-cybercrime-group-seo-fraud/ ↗ https://github.com/Cisco-Talos/IOCs/blob/main/2025/09/uat-8099-chinese-speaking-cybercrime-group-seo-fraud.txt