WhoisXML API Expands UAT-8099 Infrastructure Findings With DNS and WHOIS Analysis
Summary
WhoisXML API’s analysis expanded Cisco Talos’s UAT-8099 indicators to 10 domains and 17 subdomains, linking them through DNS and WHOIS records to 12,787 email-connected domains; four were classified as malicious. UAT-8099 reportedly targeted IIS servers in Thailand and
Key points
- WhoisXML API expanded Cisco Talos’s original 17 network indicators to 27—10 domains and 17 subdomains—after extracting apex domains and excluding legitimate domains.
- UAT-8099 reportedly targeted vulnerable IIS servers in Thailand and Vietnam, using web shells, PowerShell, GotoHTTP, and BadIIS variants.
- Thirteen of the 17 subdomains were under recently registered domains; one appeared to mimic Google and was described as potential phishing infrastructure.
- Two client IP addresses communicated with two indicator domains through 12 DNS queries between January 2 and 31, 2026.
- Three indicator domains were assessed as likely malicious 545–569 days before being identified as indicators; gtwql[.]com was one example.
- Reverse WHOIS queries on public email addresses linked to 12,787 domains, four classified as malicious; dmnsg[.]com was associated with malware distribution from 2023 to 2026.
- Seven indicator domains resolved to 13 IP addresses, 12 of which the article says had appeared in malicious campaigns.
Article Details
- Attack Vectors
- UAT-8099 reportedly targeted vulnerable IIS servers, particularly in Thailand and Vietnam.
- The operators used web shells and PowerShell to execute scripts and deploy the GotoHTTP remote-access tool on vulnerable IIS servers.
- The campaign used BadIIS variants described as hardcoded for target regions and customized by variant.
- Defensive Notes
- The article recommends conducting supplementary investigations to corroborate entities identified as threats or malicious.
- The article advises avoiding the subdomain it describes as mimicking Google; that subdomain is not provided.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ceye[.]io | Identified as a UAT-8099 campaign IoC domain in the article. |
| DOMAIN | dmnsg[.]com | The article reports this email-connected domain was associated with malware distribution from 9 March 2023 to 30 January 2026. |
| DOMAIN | gtwql[.]com | Identified as a campaign IoC; the article says it was likely registered with malicious intent 569 days before being named as an IoC. |
| DOMAIN | hunanduodao[.]com | Identified as a UAT-8099 campaign IoC domain in the article. |
| DOMAIN | jmfwy[.]com | Identified as a UAT-8099 campaign IoC domain in the article. |
MITRE ATT&CK
T1059.001 · PowerShellThe operators reportedly used PowerShell to execute scripts and deploy the GotoHTTP tool.T1105 · Ingress Tool TransferThe operators reportedly deployed the GotoHTTP remote-access tool onto vulnerable IIS servers.T1190 · Exploit Public-Facing ApplicationUAT-8099 reportedly exploited vulnerable IIS servers.T1505.003 · Web ShellThe operators reportedly deployed web shells on compromised IIS hosts.
Threat Actors
Malware
Products
Tools
Countries
ThailandThe actor exploited vulnerable IIS servers—using web shells, PowerShell, BadIIS variants, and the GotoHTTP remote-access tool—primarily targeting hosts in Thailand and Vietnam.VietnamThe actor exploited vulnerable IIS servers—using web shells, PowerShell, BadIIS variants, and the GotoHTTP remote-access tool—primarily targeting hosts in Thailand and Vietnam.