Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

Reddit NetSec

AlienVault OTX General

CVE Database V5

SANS ISC Handlers Diary

Reddit InfoSec News

Threatpost

SecurityWeek

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A Chinese-speaking threat actor conducted a large-scale SEO poisoning campaign dubbed 'Operation Rewrite' using BadIIS malware to manipulate search results. The attackers compromised legitimate websites and used malicious IIS modules to intercept web traffic and serve altered content. The campaign targeted East and Southeast Asia, particularly Vietnam. Multiple variants of BadIIS were discovered, including ASP.NET handlers and PHP scripts. The threat actor is linked to previously known groups like Group 9 and possibly DragonRank. Their toolkit allowed them to inject malicious content, redirect users, and exploit compromised servers for various malicious purposes.

Operation Rewrite is a large-scale SEO poisoning campaign attributed to a Chinese-speaking threat actor group linked to previously known entities such as Group 9 and possibly DragonRank. The attackers leveraged BadIIS malware, which consists of malicious IIS modules, ASP.NET handlers, and PHP scripts, to compromise legitimate websites primarily in East and Southeast Asia, with a particular focus on Vietnam. By implanting these malicious modules into web servers running Microsoft IIS, the threat actors intercepted and manipulated web traffic to alter search engine results and redirect users to malicious or fraudulent content. This manipulation of search engine results (SEO poisoning) enables the attackers to increase the visibility of malicious sites or content, potentially leading to further exploitation such as malware distribution, credential theft, or other malicious activities. The campaign's toolkit allows injection of malicious content directly into web pages served by compromised servers, enabling stealthy and persistent manipulation without requiring user interaction beyond visiting affected sites. The use of web shells and various exploitation techniques (referenced by MITRE ATT&CK IDs T1133, T1190, T1112, T1505.003, T1078) indicates a sophisticated approach involving initial access, persistence, and credential access to maintain control over compromised infrastructure. Although no known exploits are currently reported in the wild for this specific malware, the campaign's scale and complexity demonstrate a significant threat to web infrastructure relying on IIS servers, especially those with weak patching or security controls.

Detailed information about Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign. Get real-time updates, techni

Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign

Title	Severity	Type	Source	Date

Threats Tagged 'operation rewrite'

Stop chasing alerts. Route them.

Filter Threats

Threats Tagged 'operation rewrite'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility