Chinese-Speaking Group Manipulates SEO with BadIIS
Essential information
- Published
- 17/02/2025 11:17
- Modified
- 17/02/2025 11:29
- Tags
- 2025-02-17 asia badiis gambling websites iis exploitation malware injection seo manipulation
- Related entities
- 137 observables, 1 intrusion sets (apt), 9 techniques (mitre), 1 malware, 13 others
Description
A Chinese-speaking group is conducting an SEO manipulation campaign in Asia using BadIIS malware. The campaign targets vulnerable Internet Information Services (IIS) servers, compromising them to redirect users to illegal gambling sites or malicious servers. Affected regions include India, Thailand, Vietnam, and others, with government, universities, and tech sectors being targeted. The malware can alter HTTP responses, inject suspicious JavaScript, and perform SEO fraud. This campaign highlights the need for organizations to update and patch IIS systems, monitor for abnormal installations, restrict administrative access, and implement strong security measures to mitigate risks.