Threats Tagged 'iis modules'

WEBJACK is a malware campaign targeting Microsoft IIS servers by deploying BadIIS malware modules to conduct SEO poisoning and fraud. The attackers hijack high-profile websites, including government and educational institutions, redirecting users to gambling sites. The campaign selectively serves malicious content to search engine crawlers while redirecting or blocking normal visitors, leveraging legitimate IIS modules for stealth. Originating from a Chinese-speaking threat actor, it primarily affects Southeast Asia and Latin America, with a focus on Vietnamese-language targets. Although no known exploits are publicly reported, the campaign uses advanced tools such as Cobalt Strike and XLANY Loader. The threat demonstrates evolving IIS hijacking techniques and abuse of legitimate security tools for monetization. European organizations could be at risk if targeted due to the use of IIS servers and the potential for reputational damage and fraud. Mitigation requires specific IIS module monitoring, integrity checks, and enhanced web server security. Countries with significant IIS usage and strategic government or educational targets, such as Germany, France, and the UK, are more likely to be affected. The threat severity is assessed as medium given the targeted nature, impact on availability and integrity, and moderate ease of exploitation without user interaction.

MediumMalwareFranceGermanyItaly+4#badiis#latin america#chinese threat actor

A Chinese-speaking threat actor conducted a large-scale SEO poisoning campaign dubbed 'Operation Rewrite' using BadIIS malware to manipulate search results. The attackers compromised legitimate websites and used malicious IIS modules to intercept web traffic and serve altered content. The campaign targeted East and Southeast Asia, particularly Vietnam. Multiple variants of BadIIS were discovered, including ASP.NET handlers and PHP scripts. The threat actor is linked to previously known groups like Group 9 and possibly DragonRank. Their toolkit allowed them to inject malicious content, redirect users, and exploit compromised servers for various malicious purposes.

MediumCampaignGermanyFranceUnited Kingdom+4#badiis#dragonrank#operation rewrite