MalwarePublished 17 Feb 2026

BADIIS to the Bone: New Insights to a Global SEO Poisoning Campaign

Source AlienVault OTX General

Description

A Chinese-speaking cybercrime group, REF4033, has orchestrated a massive SEO poisoning campaign, compromising over 1,800 Windows web servers worldwide using the BADIIS malware. The campaign operates in two phases: serving keyword-stuffed HTML to search engine crawlers and redirecting victims to illicit websites. The group deploys BADIIS, a malicious IIS module, to hijack legitimate servers for manipulating search engine rankings and facilitating financial fraud. The campaign primarily targets the APAC region, with China and Vietnam accounting for 82% of compromised servers. Victims span various sectors, including government agencies, educational institutions, and financial services. The attackers use sophisticated techniques for stealth and anti-tampering, employing Chinese encryption standards and commercial obfuscation tools.

Impact

For European organizations, the BADIIS campaign presents several risks despite its primary focus on the APAC region. Organizations running IIS web servers that are publicly accessible and indexed by search engines could be targeted or indirectly affected through supply chain contamination or SEO manipulation. Compromise of government, educational, or financial sector web servers could lead to reputational damage, loss of user trust, and potential financial fraud against users redirected to malicious sites. The manipulation of search engine results can degrade the quality of search traffic, impacting marketing and operational effectiveness. Additionally, the stealthy nature of the malware and its use of encryption and obfuscation complicate detection and remediation efforts. European organizations may also face regulatory and compliance risks if compromised servers are used to facilitate fraud or distribute illicit content. The campaign’s focus on financial fraud aligns with critical sectors in Europe, increasing the potential impact on economic stability and public trust. Overall, while direct infection rates in Europe may currently be lower, the threat’s global scale and sophisticated tactics warrant proactive defense measures.

Defensive guidance

To mitigate the BADIIS threat, European organizations should implement the following specific measures: 1) Conduct thorough audits of IIS web servers to detect unauthorized modules or unusual configurations, using specialized tools capable of identifying malicious IIS modules like BADIIS. 2) Monitor web server logs and network traffic for anomalies such as unexpected redirects or unusual user-agent strings indicative of SEO poisoning activities. 3) Harden IIS server configurations by disabling unnecessary modules, enforcing strict access controls, and applying the latest security patches to the underlying OS and IIS components. 4) Employ endpoint detection and response (EDR) solutions with capabilities to detect obfuscated malware and suspicious encryption usage. 5) Implement multi-factor authentication and strong credential management to prevent initial compromise vectors such as credential theft. 6) Collaborate with search engine providers to report and remediate manipulated search results and poisoned SEO content. 7) Educate web administrators and security teams about the tactics used by REF4033 to improve incident response readiness. 8) Regularly back up web server configurations and content to enable rapid recovery in case of compromise. 9) Use web application firewalls (WAFs) to filter malicious requests and prevent unauthorized module installations. 10) Engage in threat intelligence sharing with industry peers and national cybersecurity centers to stay informed about emerging indicators of compromise related to BADIIS.

Indicators of compromise

Domains 34

gotz001.com
gotz003.com
jbtz001.com
jbtz003.com
uupbit.top
bd.gotz001.com
bd.gotz003.com
br.jbtz001.com
br.jbtz003.com
cn.gotz001.com

URLs 21

http://kr.gotz001.com/lunlian/index.php
http://se.gotz001.com/lunlian/index.php
https://cn404.gotz001.com/lunlian/index.php
https://cnse.gotz001.com/lunlian/index.php
http://bd.gotz001.com/lunlian/index.php
http://kr.gotz003.com/krfml/krfmldz.txt
http://kr.gotz003.com/krfml/krfmlip.txt
http://kr.gotz003.com/krfml/krfmllj.txt
http://kr.gotz003.com/krfml/krfmltz.txt
http://vn.jbtz001.com/lunlian/index.php

Hashes 23

02d1c2e512552ad5c9ff1e99e13beec1
039344cb9bd8fa712983e1753d8391e9
1e4b23eee1b96b0cc705da1e7fb9e2f3
26b9279a1a29e101dc4912ec90c05810
4a9f14b9da4973e46a1e28779fef6e15
68b09f69a7c14caaf52661568d51f6b7
6f39be4f6446ed6c399acde5a25711a8
b59ff1638e92ab1127b7bc76c7922245
e4d6216403e24260b5f51b394899c0f1
2060fe0d06d4409e301ff3d287bfa25ca7bdbe97

Community reviews

Loading reviews…