Attackers Weaponize Vulnerable Websites Through Automated Malware Deployment

Cybercriminal Network Hijacks Web Servers Worldwide for SEO Manipulation and Data Theft

A Chinese-speaking cybercrime group tracked as UAT-10147 has been targeting vulnerable Windows and Linux web servers globally to deploy malware, steal sensitive information, and manipulate search engine rankings for financial gain.

Security researchers from Cisco Talos identified victims across Brazil, Bolivia, China, Canada, and Vietnam, affecting organizations in government, education, media, technology, and gaming sectors.

The campaign demonstrates a growing trend where attackers combine traditional server exploitation with automated tools and artificial intelligence-assisted techniques to conduct large-scale compromises.

Large-Scale Targeting of Internet-Facing Servers

Researchers discovered evidence of a highly organized operation after an attacker-controlled download server was exposed. The server contained an open directory and a target list containing approximately 170,000 URLs.

The attackers divided the targets into multiple files, each containing around 10,000 URLs, suggesting a systematic approach to identifying vulnerable web infrastructure.

UAT-10147 primarily gains initial access by exploiting publicly known remote code execution vulnerabilities in widely used web applications, including:

- Zimbra CVE-2022-27925
- AjaxPro CVE-2021-23758
- Nacos CVE-2021-29441 and CVE-2021-29442
- Telerik UI for ASP.NET AJAX CVE-2019-18935

The Nacos exploitation activity was particularly notable because attackers used it to collect basic system information and send confirmation data back to attacker-controlled infrastructure.

Windows Servers Targeted With Persistent Malware

On compromised Windows IIS servers, attackers execute staged scripts after gaining remote access.

The infection process includes downloading additional tools using legitimate Windows utilities such as certutil, followed by privilege escalation attempts using tools like EfsPotato.

After obtaining higher privileges, attackers modify Microsoft Defender settings to exclude IIS-related directories, helping malware avoid detection.

The group also uses IIS management tools to identify valuable websites before deploying the BadIIS malware family, which is designed to manipulate web traffic.

For persistence, UAT-10147 creates unauthorized administrator accounts, enables Remote Desktop access, and schedules malicious tasks disguised as legitimate software updates.

Linux Systems Infected Through Web Shells and Rootkits

Linux servers are targeted through vulnerable applications that allow attackers to upload web shells and execute commands remotely.

After gaining access, attackers attempt privilege escalation using known vulnerabilities, including:

- Dirty Pipe (CVE-2022-0847)
- Baron Samedit (CVE-2021-3156)
- CVE-2022-0995

Successful escalation allows deployment of multiple implants, including NoodleRAT, Meterpreter, and SPECTRE.

These tools provide attackers with remote control capabilities, credential theft functions, process manipulation, and anti-analysis features.

BadIIS Malware Used for Search Manipulation

The main objective of the operation appears to be financial exploitation through BadIIS malware.

Unlike traditional malware focused only on data theft, BadIIS targets web traffic and search engine visibility.

The malware can:

- Redirect website visitors
- Modify responses sent to search crawlers
- Inject unauthorized backlinks
- Manipulate search rankings
- Redirect users to malicious or fraudulent destinations

Researchers have previously observed BadIIS being used among Chinese-speaking cybercrime groups because its configurable design allows attackers to quickly deploy SEO fraud campaigns.

AI-Assisted Operations Increase Attack Scale

A major development in this campaign is the use of artificial intelligence-assisted tooling.

Researchers found evidence of AI-generated scripts and automated workflows used to improve exploitation, validate vulnerabilities, check system permissions, deploy malware, and create web shells.

The attackers also used tools such as Metasploit, ysoserial, PentestGPT, and DeepAudit to reduce manual effort and automate parts of the intrusion process.

This combination of AI assistance and existing exploitation frameworks allows attackers to conduct more efficient attacks against large numbers of exposed servers.
## H2: Defensive Recommendations
Organizations should prioritize securing internet-facing applications and monitoring for signs of compromise.