Chinese-Speaking Cybercrime Group Targets Web Servers with BadIIS Malware

A Chinese-speaking cybercrime group, tracked as UAT-10147, is targeting vulnerable Windows and Linux web servers worldwide to deploy BadIIS malware, steal data, and manipulate search engine results for financial gain.

The group has been identified by Cisco Talos researchers, who observed victims in Brazil, Bolivia, China, Canada, and Vietnam, spanning government, education, media, technology, and gaming organizations.

Initial access relies primarily on exploitation of publicly disclosed remote-code-execution flaws, including Zimbra CVE-2022-27925, AjaxPro CVE-2021-23758, Nacos CVE-2021-29441 and CVE-2021-29442, and Telerik UI for ASP.NET AJAX CVE-2019-18935.

The group then deploys web shells on Linux systems after exploiting vulnerable applications, and attempts local privilege escalation using a broad collection of known flaws. Root-level access enables deployment of implants such as NoodleRAT, Meterpreter, and SPECTRE, a cross-platform backdoor that supports command-and-control, credential theft, process injection, anti-analysis functions, and Linux rootkit or BYOVD-oriented capabilities.