Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign

A Chinese-speaking threat actor conducted a large-scale SEO poisoning campaign dubbed 'Operation Rewrite' using BadIIS malware to manipulate search results. The attackers compromised legitimate websites and used malicious IIS modules to intercept web traffic and serve altered content. The campaign targeted East and Southeast Asia, particularly Vietnam. Multiple variants of BadIIS were discovered, including ASP.NET handlers and PHP scripts. The threat actor is linked to previously known groups like Group 9 and possibly DragonRank. Their toolkit allowed them to inject malicious content, redirect users, and exploit compromised servers for various malicious purposes.

• BADIIS to the Bone: New Insights to a Global SEO Poisoning CampaignMalware2026-02-17
• NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779ExploitedMalware2026-10-20
• SEO Poisoning Campaign Delivers New Armorsteal MalwareMalware2026-10-22
• Q3 2026 Statistical Report on Malware Targeting Windows Database ServersMalware2026-10-14
• Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed ClientCampaign2026-10-13