Chinese attackers steal data and hijack websites
A Chinese-speaking criminal group called UAT-10147 breaks into Windows and Linux web servers to steal data and quietly hijack search results for money. Once inside, it plants a tool called BadIIS that redirects visitors and boosts scam sites in search rankings.
- Report priority
- Medium
- Involves
- Zimbra
What is known
The group breaks in by exploiting known, unpatched flaws in web software, including Zimbra email servers, AjaxPro, Nacos, and Telerik UI for ASP.NET AJAX, then installs remote access tools and rogue administrator accounts to keep control.
What to do
Check whether your web server runs Zimbra (patched for CVE-2022-27925), AjaxPro (CVE-2021-23758), Nacos (CVE-2021-29441 and CVE-2021-29442), or Telerik UI for ASP.NET AJAX (CVE-2019-18935), and compare your installed version against each vendor's fixed release.
Update each affected product to the version that fixes its listed CVE, then review Microsoft Defender exclusion lists, local administrator accounts, and scheduled tasks named things like "Google Chrome Start" for signs of tampering, since there is no single vendor patch that covers this whole campaign.
Reported details
UAT-10147 finds a government, education, or media website running one of the unpatched programs it targets, such as Zimbra or Telerik UI for ASP.NET AJAX. It exploits the flaw to run its own commands on the server, then hides its tools inside the web server's own program folders. From there it installs BadIIS, which quietly rewrites what search engines and visitors see, steering search traffic toward the group's own sites for profit.
UAT-10147 gains initial access via public RCE flaws (Zimbra CVE-2022-27925, AjaxPro CVE-2021-23758, Nacos CVE-2021-29441/29442, Telerik UI CVE-2019-18935). On Windows IIS, batch scripts use certutil to fetch EfsPotato for privilege escalation and QuasarRAT disguised as svchosts.exe, add System32\inetsrv and SysWOW64\inetsrv to Defender exclusions, enumerate sites via appcmd, and create rogue admin/RDP users plus a scheduled task masquerading as Google Chrome Start. On Linux, web shells lead to privilege escalation via Dirty Pipe (CVE-2022-0847), Baron Samedit (CVE-2021-3156), and CVE-2022-0995, deploying NoodleRAT, Meterpreter, or the SPECTRE backdoor.
BadIIS then hijacks traffic and search rankings. Talos found the group using AI-assisted tooling (agentic playbooks, PentestGPT, DeepAudit) to automate exploitation and validation.