---
title: Chinese Hackers Turn Reputable Websites Into SEO Spam Machines While Stealing Data
description: Chinese cybercrime group UAT-8099 exploits IIS servers at universities and tech firms, flooding search engines with spam and stealing data.
canonical_url: https://codekeeper.co/ticker/chinese-cybercrime-group-exploits-iis-servers
---

# Chinese Hackers Turn Reputable Websites Into SEO Spam Machines While Stealing Data

Chinese cybercrime group UAT-8099 exploits IIS servers at universities and tech firms, flooding search engines with spam and stealing data.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Oct 4, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-cybercrime-group-exploits-iis-servers%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-cybercrime-group-exploits-iis-servers%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-cybercrime-group-exploits-iis-servers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-cybercrime-group-exploits-iis-servers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-cybercrime-group-exploits-iis-servers%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-cybercrime-group-exploits-iis-servers%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A Chinese cybercrime group called UAT-8099 is hijacking web servers at universities, tech companies, and telecom providers worldwide to run a sophisticated dual-purpose operation. The hackers exploit vulnerable Internet Information Services (IIS) servers, then install "BadIIS" malware that floods search engines with gambling-related spam terms while redirecting unsuspecting users to illegal gambling sites. The attack is particularly clever because legitimate visitors see nothing unusual, making it nearly invisible to website owners. Meanwhile, the hackers steal sensitive data including credentials and certificates for future attacks or dark web sales. Victims span multiple countries including Brazil, Canada, India, Thailand, and Vietnam. Security experts warn that the same vulnerabilities could be exploited for more damaging attacks like credential theft or website defacement. **Source:** [Dark Reading](https://www.darkreading.com/cyberattacks-data-breaches/uat-8099-hijacks-reputable-sites-seo-fraud-theft)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-cybercrime-group-exploits-iis-servers%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-cybercrime-group-exploits-iis-servers%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-cybercrime-group-exploits-iis-servers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-cybercrime-group-exploits-iis-servers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-cybercrime-group-exploits-iis-servers%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-cybercrime-group-exploits-iis-servers%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Critical N-Central Flaw Gives Hackers Full Admin Access to MSP Platforms Aug 11, 2026](https://codekeeper.co/ticker/critical-n-central-rmm-vulnerability-cve-2026-18577)

[Hackers Steal 740,000 Pieces of Data from UK Education Department and Police Database Aug 11, 2026](https://codekeeper.co/ticker/exfilsquad-hacks-uk-databases-stealing-records)

[Cyberattacks China-Linked Warlock Ransomware Still Breaking Into Utilities Oct 5, 2026](https://codekeeper.co/ticker/warlock-ransomware-sharepoint-attacks)

[Data breaches McKesson Confirms Data Breach as ShinyHunters Threatens to Leak 284 Million Records Sep 1, 2026](https://codekeeper.co/ticker/mckesson-data-breach-shinyhunters-extortion)