Threats Tagged 'dragonrank'

A Chinese-speaking threat actor group, tracked as CL-UNK-1037, has been conducting a large-scale SEO poisoning campaign called Operation Rewrite. The attackers use a malicious IIS module named BadIIS to intercept and alter web traffic on compromised servers, manipulating search engine results to redirect users to malicious sites. The campaign primarily targets East and Southeast Asia, with a focus on Vietnam. The attackers employ various tools including native IIS modules, ASP.NET handlers, and PHP scripts. The operation shows links to previously known threat groups like Group 9 and possibly DragonRank. The campaign demonstrates sophisticated techniques for search result manipulation and traffic redirection, posing significant risks to unsuspecting internet users.

MediumMalwareVietnamChinaSingapore+3#dragonrank#iis module#seo poisoning

A Chinese-speaking threat actor conducted a large-scale SEO poisoning campaign dubbed 'Operation Rewrite' using BadIIS malware to manipulate search results. The attackers compromised legitimate websites and used malicious IIS modules to intercept web traffic and serve altered content. The campaign targeted East and Southeast Asia, particularly Vietnam. Multiple variants of BadIIS were discovered, including ASP.NET handlers and PHP scripts. The threat actor is linked to previously known groups like Group 9 and possibly DragonRank. Their toolkit allowed them to inject malicious content, redirect users, and exploit compromised servers for various malicious purposes.

MediumCampaignGermanyFranceUnited Kingdom+4#badiis#dragonrank#operation rewrite