{
  "name": "Dissecting UAT-8099: New persistence mechanisms and regional focus",
  "slug": "dissecting-uat-8099-new-persistence-mechanisms-and-regional-focus",
  "description": "UAT-8099, a threat actor targeting vulnerable IIS servers across Asia, has launched a new campaign from late 2025 to early 2026. The group's tactics have evolved, focusing on Thailand and Vietnam, and employing web shells, PowerShell scripts, and the GotoHTTP tool for remote access. New variants of BadIIS malware now include region-specific features, with separate versions targeting Vietnam and Thailand. The actor has expanded their toolkit to include utilities for log removal, file protection, and anti-rootkit capabilities. They've also adapted their persistence methods, creating hidden user accounts and leveraging legitimate tools to evade detection. The campaign demonstrates significant operational overlaps with the WEBJACK campaign, including shared malware hashes, C2 infrastructure, and victimology.",
  "published": "2026-01-29T16:20:34+00:00",
  "created_at": "2026-01-29T16:20:34+00:00",
  "modified_at": "2026-01-30T07:19:29+00:00",
  "created_at_opencti": "2026-01-29T16:20:34+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-01-29",
    "asia",
    "badiis",
    "gotohttp",
    "iis",
    "persistence",
    "powershell",
    "regional targeting",
    "seo fraud",
    "thailand",
    "vietnam",
    "web shells"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "https://404.imxzq.com/tdks.php?domain=%s\\u0026path=%s"
      },
      {
        "id": "",
        "name": "https://fql.jmfwy.com/tdks.php?domain=%s\\u0026path=%s"
      },
      {
        "id": "",
        "name": "https://bxphp.westooo.com/u.php"
      },
      {
        "id": "",
        "name": "http://tz.ohtcm.com/jump/json.js"
      },
      {
        "id": "",
        "name": "http://tz.suucx.com/jump/ov.js"
      },
      {
        "id": "",
        "name": "https://api.githubcopilot.com"
      },
      {
        "id": "",
        "name": "http://tz.jmfwy.com/jump/json.js"
      },
      {
        "id": "",
        "name": "https://th.gtwql.com/1018.php?domain=%s\\u0026path=%s"
      },
      {
        "id": "",
        "name": "http://404.imxzq.com/tdks.php?domain=%s\\u0026path=%s"
      },
      {
        "id": "",
        "name": "http://tdk.hunanduodao.com/tdk.php?domain=%s\\u0026path=%s"
      },
      {
        "id": "",
        "name": "http://tdkfsdfa.cnmseo.com/jump/fql.js"
      },
      {
        "id": "",
        "name": "http://tdk.hunanduodao.com/jump/fql.js"
      },
      {
        "id": "",
        "name": "http://tz.ohtcm.com/jump/ll.js"
      },
      {
        "id": "",
        "name": "https://tdk.jmfwy.com/tdk.php?domain=%s\\u0026path=%s"
      },
      {
        "id": "",
        "name": "http://tz.jmfwy.com/jump/mage.js"
      },
      {
        "id": "",
        "name": "http://tz.ohtcm.com/jump/fql.js"
      },
      {
        "id": "",
        "name": "https://bxphp.westooo.com/?xhost=%s\\u0026url=%s\\u0026ua=Googlespider\\u0026f=bd"
      },
      {
        "id": "",
        "name": "https://7070-ppxcx-a1-3gg5ufwp666ee644-1300076834.tcb.qcloud.la/test/zcgo/go.exe"
      },
      {
        "id": "",
        "name": "http://tz.ohtcm.com/jump/ov.js"
      },
      {
        "id": "",
        "name": "https://7070-ppxcx-a1-3gg5ufwp666ee644-1300076834.tcb.qcloud.la/test/zcgo/zcgo1.vbs"
      },
      {
        "id": "",
        "name": "https://799.cors5.vip/1018.php?domain=%s\\u0026path=%s"
      },
      {
        "id": "",
        "name": "https://thov.hunanduodao.com/tdks.php?domain=%s\\u0026path=%s"
      },
      {
        "id": "",
        "name": "http://tdkfsdfa.cnmseo.com/jump/ll.js"
      },
      {
        "id": "",
        "name": "https://bxphp.westooo.com/58z.js"
      },
      {
        "id": "",
        "name": "http://tz.jmfwy.com/jump/tiger.js"
      },
      {
        "id": "",
        "name": "https://404.jmfwy.com/tdks.php?domain=%s\\u0026path=%s"
      },
      {
        "id": "",
        "name": "http://tdk.hunanduodao.com/jump/ov.js"
      },
      {
        "id": "",
        "name": "http://go1.kmm5tn.ceye.io"
      },
      {
        "id": "",
        "name": "8ae8fabe7c3d9f8aef24c4eda323ab8640a56d51deb88fe58e5baf648d9e06b6"
      },
      {
        "id": "",
        "name": "e84a16c8e25a4e40926cbb4cc210a09830298b6f99d532035f5136d05ffc008c"
      },
      {
        "id": "",
        "name": "21a43568025709b66240454fc92d4f09335a96863f8ab1c46b4a07f6a5b67102"
      },
      {
        "id": "",
        "name": "4bc189af91779582a1d29cfe187aa233e7ba50d223261fb9fbe31df5b06dff96"
      },
      {
        "id": "",
        "name": "a5899f6dfde0ea5a79be562ca8ca01e11673c1d36a037847396db0c949014259"
      },
      {
        "id": "",
        "name": "265336511db98a4c40476455e2ae93aaf926abecd8f9b9d741f8d253abb80357"
      },
      {
        "id": "",
        "name": "bcc393c1686a0f5d493041e98dcafe0098d952d5e93eb4d2ebdb63c0efd2de33"
      },
      {
        "id": "",
        "name": "11ea6aa2b31677f8a36627d4af709e70cff4a033b0975f63c19b28945e6226b7"
      },
      {
        "id": "",
        "name": "3710817d7f6ddd39e1ce2dfb687d634768a3b672b9baf8134b695d51699defdb"
      },
      {
        "id": "",
        "name": "9458a75c1e24add9a48e0425e514a5f0cb46a826bff30ea7ea34e69099345f29"
      },
      {
        "id": "",
        "name": "ebeef831c52b7e930a6456caedf7849814b8d4def2bc0e70a0e7a357621ef6bc"
      },
      {
        "id": "",
        "name": "1ab98783a02ad9f127e776c435ef4e24a18ab93c4b4ee5ede722817d4b20771a"
      },
      {
        "id": "",
        "name": "c7a22f5c55ac1373a5964a6598da2a9afd8a61b9d729b9bf52a93c967a7f0eda"
      },
      {
        "id": "",
        "name": "91e1f4fc92f104ec8b29bb56df87f8e7d8b518c63997e2ea162d3f1cac3fcac1"
      },
      {
        "id": "",
        "name": "e448557d26cf2917efded8e30c67db8094ce1f6db78801742988ea21f3429d7c"
      },
      {
        "id": "",
        "name": "672ffdf1e9d4848015d29a68111266ef55fc6702dfe7b2053ce677882648dd5d"
      },
      {
        "id": "",
        "name": "33d3ccf82279d94a8e8e772a0c4963d65a1f3576dbd6ed7b4ab8a0ee4869f97f"
      },
      {
        "id": "",
        "name": "29ffb1d28f98582e81e78e6b2d5502da50c8ebdee0d40005a86b0dadece2923b"
      },
      {
        "id": "",
        "name": "d8c0ef6dbf7d4572f92d3a492f32061ab8f3dd46beb9ff5a0bf9bf550935458c"
      },
      {
        "id": "",
        "name": "230b84398e873938bbcc7e4a1a358bde4345385d58eb45c1726cee22028026e9"
      },
      {
        "id": "",
        "name": "9a2fd34e22c5f3d3d5fb96e3cd514dad7b03ed7bf53a87e7d8d9b73987d02ece"
      },
      {
        "id": "",
        "name": "cdf454173bac13266e0f7db5de386439f197e2c480e1cc303dd7e806484645da"
      },
      {
        "id": "",
        "name": "1ece4d8603f5e28a7b0f6a8c83963a57cf23e5d2fadfc138419c3a051a75c93a"
      },
      {
        "id": "",
        "name": "416ef6da8a27a99cbce6517d31857c8b8b55f02e9c8118510dc33814fb6f57be"
      },
      {
        "id": "",
        "name": "4e4bf7bea9c29f1e3eec31fed088105fce2256503ae1bc0064d13a22655d5afc"
      },
      {
        "id": "",
        "name": "565502d2454e4b65d3bd810fccf4b429264562fefa5cfff24c905b76b3b860a6"
      },
      {
        "id": "",
        "name": "0ee9ae80ec4321e20bf8358d95741a79e88d8d82d6b509cda2468891aa00ecfd"
      },
      {
        "id": "",
        "name": "660ccb6dcfad97bfaddc667c61b1904e99a06eab981d44119092624d42912d68"
      },
      {
        "id": "",
        "name": "50d60071257d18b32330d912202dc320d501c221ea1591db8fbf19715460d571"
      },
      {
        "id": "",
        "name": "48ec6530470b295db455bf2c72dc4fbd18672725f45821304f966d436b428865"
      },
      {
        "id": "",
        "name": "383ac5ccf706a0d980c0805a892361b7be68e1b3fd9236336fdc2b239d96842c"
      },
      {
        "id": "",
        "name": "9d4c15e9d3ac761940046614093cf8b50480d4d9004365d5f48bed0739320d2a"
      },
      {
        "id": "",
        "name": "a34ea8fb565ac6f57eefc987c61159c1e6f1af6a8717ffb42f4b745db3bf9e31"
      },
      {
        "id": "",
        "name": "a781581baf6e1e335f22c9ffbb2656a2d9c8e51f463e3a48068210425df1c205"
      },
      {
        "id": "",
        "name": "5213eae389c10a1e1e59001c89a5baad76b54233989b95382178233fe15a039d"
      },
      {
        "id": "",
        "name": "6229437844e2cf3153e3b9efa2ea17ff3954d46eb1875813c22400fdf136be72"
      },
      {
        "id": "",
        "name": "2cc87bd2ae25a5119cb950618850eddeb578954fa780b125c1f51d234fb405e3"
      },
      {
        "id": "",
        "name": "70d6bc89451e36889c045f30de22bc02e032788c8938baa0d5802e8f747c3e79"
      },
      {
        "id": "",
        "name": "5d320b60d2f40c200e81eaeb67a86a04782bff84582c73e726255dba2dcb821e"
      },
      {
        "id": "",
        "name": "6be5c8882bc02cf4e86d2ab9d20aa3446b71dd12c73f9c6bf0faf9412d7d23ba"
      },
      {
        "id": "",
        "name": "f3abb0cc802f3d7b95fc8762b94bdcb13bf39634c40c357301c4aa1d67a256fb"
      },
      {
        "id": "",
        "name": "6b60b6df8a1a95f51ffe57255c05d26eb9e113857efac3b29d6ef080b8d414f3"
      },
      {
        "id": "",
        "name": "99f2c4773560eb515cfcb0ad45cf8e47c46580ab19494463160f885e048ce830"
      },
      {
        "id": "",
        "name": "56be91643dd8b86f347cc8d743c568f2d0169781ba999a2f708e503b59ecff76"
      },
      {
        "id": "",
        "name": "ab03a7caed279fc6411ec19386faff3b65be34c91c3f0550eaef84a663720d0d"
      },
      {
        "id": "",
        "name": "187e1417fd9d4f4a44e4f7b7172aef056e9d0ab5d7a7addf61c2cfa893f74fd1"
      }
    ],
    "malware": [
      {
        "id": "3b09b708-d42b-4fc4-a892-b5b7e8cb0656",
        "name": "GotoHTTP",
        "slug": "gotohttp"
      },
      {
        "id": "07267fd6-d853-4167-9f07-ae86fc4c1bda",
        "name": "BadIIS",
        "slug": "badiis"
      }
    ],
    "intrusion_sets": [
      {
        "id": "4f004976-498b-47d9-861e-9041f2ec6736",
        "name": "UAT-8099",
        "slug": "uat-8099"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "India"
      },
      {
        "id": "",
        "name": "British Indian Ocean Territory"
      },
      {
        "id": "",
        "name": "Japan"
      },
      {
        "id": "",
        "name": "Pakistan"
      },
      {
        "id": "",
        "name": "Thailand"
      },
      {
        "id": "",
        "name": "tz.jmfwy.com"
      },
      {
        "id": "",
        "name": "thov.hunanduodao.com"
      },
      {
        "id": "",
        "name": "fql.jmfwy.com"
      },
      {
        "id": "",
        "name": "tz.ohtcm.com"
      },
      {
        "id": "",
        "name": "tdkfsdfa.cnmseo.com"
      },
      {
        "id": "",
        "name": "tdk.hunanduodao.com"
      },
      {
        "id": "",
        "name": "799.cors5.vip"
      },
      {
        "id": "",
        "name": "7070-ppxcx-a1-3gg5ufwp666ee644-1300076834.tcb.qcloud.la"
      },
      {
        "id": "",
        "name": "w3c.sneaws.com"
      },
      {
        "id": "",
        "name": "google.sneaws.com"
      },
      {
        "id": "",
        "name": "404.imxzq.com"
      },
      {
        "id": "",
        "name": "th.gtwql.com"
      },
      {
        "id": "",
        "name": "go1.kmm5tn.ceye.io"
      },
      {
        "id": "",
        "name": "404.jmfwy.com"
      },
      {
        "id": "",
        "name": "tz.suucx.com"
      },
      {
        "id": "",
        "name": "tdk.jmfwy.com"
      },
      {
        "id": "",
        "name": "2fgithub.com"
      },
      {
        "id": "",
        "name": "bxphp.westooo.com"
      }
    ]
  },
  "external_refs": [
    "https://blog.talosintelligence.com/uat-8099-new-persistence-mechanisms-and-regional-focus/",
    "https://otx.alienvault.com/pulse/697b96e2955f456977e00c46"
  ]
}