Elliptic Systems Blogs

High-Value IIS Servers Under Attack: SEO Fraud, Data Theft, and What Your Team Should Do

by: Eric StefanikPublished on: 10/05/2025

Cisco Talos has uncovered a broad campaign—tracked as UAT-8099—targeting vulnerable Internet Information Services (IIS) servers to manipulate search rankings and funnel high-value traffic to malicious destinations. The adversary leverages open file uploads and web shells to establish persistence, then uses tailored responses to search crawlers and visitors to inflate SEO while exfiltrating data and distributing malware.