Search engine optimization (SEO) fraud has been linked to the Chinese-speaking cybercrime group UAT-8099. Microsoft Internet Information Services (IIS) servers are the intended target of the attacks. The majority of infections were found in universities, tech companies, and telecom providers in India, Thailand, Vietnam, Canada, and Brazil.

Targets of the group, which was initially identified in April 2025, are mostly mobile users with both Android and Apple iPhone devices. The installation of BadIIS malware, which has been used by several Chinese-speaking threat clusters like DragonRank and Operation Rewrite (also known as CL-UNK-1037), is the final step in the attack chain. According to Cisco Talos, the actor uses backlinking, a traditional SEO strategy, to increase website visibility.

Although the exact number of compromised servers is unknown at this time, it is thought to be in the hundreds. Backlinks are used by Google's search engine to find more websites and determine the relevance of keywords. More backlinks make a website more likely to be visited by Google crawlers, which can speed up ranking improvements and increase the exposure of the webpages.

However, Google may penalize you for merely building backlinks without considering their quality. Return to Mail Online.Return to the original page. Returning Return to the page from which you originated.returning to the pages from which you came, Back to the page you were coming from, back to the page you were coming from, front to the page you were coming from, back to the site you were heading from, top to the site you were heading from, and more.

Return to the URL we were following, the page we were on, the site we were going to, and the page we were visiting.