{
  "name": "Chinese-Speaking Group Manipulates SEO with BadIIS",
  "slug": "chinese-speaking-group-manipulates-seo-with-badiis",
  "description": "A Chinese-speaking group is conducting an SEO manipulation campaign in Asia using BadIIS malware. The campaign targets vulnerable Internet Information Services (IIS) servers, compromising them to redirect users to illegal gambling sites or malicious servers. Affected regions include India, Thailand, Vietnam, and others, with government, universities, and tech sectors being targeted. The malware can alter HTTP responses, inject suspicious JavaScript, and perform SEO fraud. This campaign highlights the need for organizations to update and patch IIS systems, monitor for abnormal installations, restrict administrative access, and implement strong security measures to mitigate risks.",
  "published": "2025-02-17T10:17:26+00:00",
  "created_at": "2025-02-17T10:17:26+00:00",
  "modified_at": "2025-02-17T10:29:03+00:00",
  "created_at_opencti": "2025-02-17T10:17:26+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-02-17",
    "asia",
    "badiis",
    "gambling websites",
    "iis exploitation",
    "malware injection",
    "seo manipulation"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "45.120.81.62"
      },
      {
        "id": "",
        "name": "38.207.248.230"
      },
      {
        "id": "",
        "name": "185.106.178.76"
      },
      {
        "id": "",
        "name": "156.229.134.13"
      },
      {
        "id": "",
        "name": "154.7.64.81"
      },
      {
        "id": "",
        "name": "www.xxxx.vip"
      },
      {
        "id": "",
        "name": "www.xiagao886.com"
      },
      {
        "id": "",
        "name": "www.m2313.com"
      },
      {
        "id": "",
        "name": "www.jumpiis8.com"
      },
      {
        "id": "",
        "name": "yyds.tmpdrsh.com"
      },
      {
        "id": "",
        "name": "wailian.zavinac.net"
      },
      {
        "id": "",
        "name": "wailian.eglotanygfa.vip"
      },
      {
        "id": "",
        "name": "wailian.vn6789sky.com"
      },
      {
        "id": "",
        "name": "wailian.brcknkblue.com"
      },
      {
        "id": "",
        "name": "vnfll22.keeploong.com"
      },
      {
        "id": "",
        "name": "vn.coronavg99.com"
      },
      {
        "id": "",
        "name": "th.ntxx.cn"
      },
      {
        "id": "",
        "name": "tdkgpt.yyds6686.com"
      },
      {
        "id": "",
        "name": "sitemap1.bet277.vip"
      },
      {
        "id": "",
        "name": "tdk.798love.com"
      },
      {
        "id": "",
        "name": "sitemap.bet277.vip"
      },
      {
        "id": "",
        "name": "site.toptopkm88.com"
      },
      {
        "id": "",
        "name": "se2.ggseocdn2.com"
      },
      {
        "id": "",
        "name": "se2.ggseocdn.com"
      },
      {
        "id": "",
        "name": "phpmap.googlecache.cc"
      },
      {
        "id": "",
        "name": "newthmap.googlecache.cc"
      },
      {
        "id": "",
        "name": "newth.googlecache.cc"
      },
      {
        "id": "",
        "name": "lucky.668823.com"
      },
      {
        "id": "",
        "name": "link.vdfskis888.com"
      },
      {
        "id": "",
        "name": "link.toptoplm88.com"
      },
      {
        "id": "",
        "name": "link.topck008.com"
      },
      {
        "id": "",
        "name": "ldy.vdfskis888.com"
      },
      {
        "id": "",
        "name": "jsc.bet277.vip"
      },
      {
        "id": "",
        "name": "js.targetedtrafficcrew.com"
      },
      {
        "id": "",
        "name": "js.officefonts-clo.com"
      },
      {
        "id": "",
        "name": "html.aafd.tv"
      },
      {
        "id": "",
        "name": "js.cloudflare.cyou"
      },
      {
        "id": "",
        "name": "br.zmdesf.cn"
      },
      {
        "id": "",
        "name": "br.ruicaisiwang.com"
      },
      {
        "id": "",
        "name": "bb.vdfskis888.com"
      },
      {
        "id": "",
        "name": "all.targetedtrafficcrew.com"
      },
      {
        "id": "",
        "name": "798.toptopkm88.com"
      },
      {
        "id": "",
        "name": "zavinac.net"
      },
      {
        "id": "",
        "name": "yitongmingde.com"
      },
      {
        "id": "",
        "name": "vn6789sky.com"
      },
      {
        "id": "",
        "name": "topck008.com"
      },
      {
        "id": "",
        "name": "vg9920.store"
      },
      {
        "id": "",
        "name": "six2fc.com"
      },
      {
        "id": "",
        "name": "s995.vip"
      },
      {
        "id": "",
        "name": "qiqiguaiguai2.xyz"
      },
      {
        "id": "",
        "name": "jumpsexxx.com"
      },
      {
        "id": "",
        "name": "googleseo.life"
      },
      {
        "id": "",
        "name": "eglotanygfa.vip"
      },
      {
        "id": "",
        "name": "coronavg99.xyz"
      },
      {
        "id": "",
        "name": "chem-db.com"
      },
      {
        "id": "",
        "name": "bryyds.com"
      },
      {
        "id": "",
        "name": "brcknkblue.com"
      },
      {
        "id": "",
        "name": "aafd.tv"
      },
      {
        "id": "",
        "name": "89vq.me"
      },
      {
        "id": "",
        "name": "668th.com"
      },
      {
        "id": "",
        "name": "ll.olacityviet.com"
      },
      {
        "id": "",
        "name": "jsc.olacityviet.com"
      },
      {
        "id": "",
        "name": "ffceed66dd9935c92ff7922bd5fdfde08e9a2ff78dd3a76dc65a200305779b9c"
      },
      {
        "id": "",
        "name": "fe14c579308d356c64bd3be9365014de805a17abab8cb741e2817b8451a92f64"
      },
      {
        "id": "",
        "name": "fec618c4f832d8a182fc1d3b9e58a0bff1a62241a1d17108e84ed1f0c4bb7845"
      },
      {
        "id": "",
        "name": "fbd3d1828592a2c1f154ebe2283643e24dee1db9f8989ce32e54b00d470a0096"
      },
      {
        "id": "",
        "name": "facfea68fe95fc81e3b6e04f79fbcba738c79b4de2d0238e4e5a8ba095a2516d"
      },
      {
        "id": "",
        "name": "f9017361349421728fc1ac1bc1549b3d23b35bd795f0a83be2e9e517bccaccdc"
      },
      {
        "id": "",
        "name": "f1dcd2809a001a0d0ea3221939f7afd2ef9e5bf468709bd91abd70c902c42d45"
      },
      {
        "id": "",
        "name": "ed3882a77cdc372f647e647b66979525a50054a580b43499ce5a97864d772730"
      },
      {
        "id": "",
        "name": "eda7a7edc01392706a872a5a275940b4a4b9471dc562eb70128ee672872d1407"
      },
      {
        "id": "",
        "name": "e927d6ea1fdc27c0ae9eb55254bbbd4f501f14ae02e499d7d20cdd83af479b20"
      },
      {
        "id": "",
        "name": "e8201b4a0f2619224e0720034dfc19a75f77582531bd98a2465a58bbf4a9f8c6"
      },
      {
        "id": "",
        "name": "e645ee394546db818350adfb2c55bffea78f405ac0ebb3fb1486e7d2f042c46f"
      },
      {
        "id": "",
        "name": "e3c73f76f7b08ab6e223918a5b961201f60934ec95e5362529a42c1655395443"
      },
      {
        "id": "",
        "name": "e3197285c98965ca0522d3683c0d656e4ab1f8335ca322e1ae8c06b79dfd9b9c"
      },
      {
        "id": "",
        "name": "e09067e3e134e620b69117caf5bee54c1066b7259b74ddf2399afc64116690c9"
      },
      {
        "id": "",
        "name": "df75b0b8ea1f75f0039c158c89e413ed6c4352309cc2cfa282afd1857676a88c"
      },
      {
        "id": "",
        "name": "cc67b50d746b23b9bc6fc12dde8c64d72c7f856521787b964598672d83525915"
      },
      {
        "id": "",
        "name": "c75a9a104e340473b72140127f3039a08f99a334887afc100d09cffa3c4c8e24"
      },
      {
        "id": "",
        "name": "c732067b3d8763c248051366ab7beeae0d7fbe105884d4d3f8647e3427f36daf"
      },
      {
        "id": "",
        "name": "bf45c48b209e5004520b5d541e406c183bccb2fe81f3974c2c53be48017f74ca"
      },
      {
        "id": "",
        "name": "bbf9d7dafba979ef9c1e8531a20d3bea1adcdbb628816ce8781d7eeb6292f265"
      },
      {
        "id": "",
        "name": "bb9b0b20d239b2f5fe6da31fc2d13ec4ba6083238df68befd33d7521570d334e"
      },
      {
        "id": "",
        "name": "b6844533bb887e870eb88fba88ed4d616ea8a9573b673faf927846c802f7817c"
      },
      {
        "id": "",
        "name": "a68d83fd210b8ca21370a0f38da8fc0dd20b081e69beef911060924aa708a280"
      },
      {
        "id": "",
        "name": "a4906b40232726948f6a5357ad0ee9445512b422ae510d2ef08bd9cf516852bd"
      },
      {
        "id": "",
        "name": "a383c13bbe949d0b6dff23e3243c7bbac1813d2ce9d99149cd5b984f051005d0"
      },
      {
        "id": "",
        "name": "a35f810ed9ffd884d0599aa391d0043ad955e821f8144089116b15f01b8a932b"
      },
      {
        "id": "",
        "name": "a2a9dcdfc6f0aab577bc0f2750ff44050034c0f1c2f8b325a246f4dfe5f33219"
      },
      {
        "id": "",
        "name": "a0bb95eafc9913633c7e27f0f1e6c81eb4c138a809c109ad3abae5fcc47c2cbd"
      },
      {
        "id": "",
        "name": "a01ae86a356373f0d3e1b843f50243394308a96bd01978b33e4a91c0f0b19cce"
      },
      {
        "id": "",
        "name": "9fbae4ed1de2b09af9a246a021f2a7fc8667492d459ac346eba6719509c41c5a"
      },
      {
        "id": "",
        "name": "92e8076a59831156af5dc7058356cc0ad3dbd3c32cd84b08c3c8541ccc32d1c0"
      },
      {
        "id": "",
        "name": "8fee015ae0e978e39af2cd1ca74b29202e702d296c110f3a7a90dfadce28d4a6"
      },
      {
        "id": "",
        "name": "8eb51f51eea27de8b976bdbcc84f4cf386256dfd9dc3702df8f839490699e173"
      },
      {
        "id": "",
        "name": "8ae43e6bd2cf0f8ced8f888226a4d6d06a7b03552e9af3d3cde35bb1d9724867"
      },
      {
        "id": "",
        "name": "8a49966eb90acc5c05a6bba523f1dd0d58127ab731d44c7304204fa02bf61186"
      },
      {
        "id": "",
        "name": "89169f480810198a2cbb28fab15e0dfc8d1ee53981a9834cb84a84d077db3d17"
      },
      {
        "id": "",
        "name": "7ccdd8966adf04ddd9b24dac0d1b8642968598a88ec3f5048b279843bffefb84"
      },
      {
        "id": "",
        "name": "7b190719c3fb9c0bde074981adaf5b04356c9c48fa2fccdb334c4ae218f66fc0"
      },
      {
        "id": "",
        "name": "79b7fe6db452edd3077fb55906beea64c19087a19e5fb35211dd80975db74f9e"
      },
      {
        "id": "",
        "name": "7321d599e777088356d7549e638b6b67fc43fc5c9f0c8846ee5aa7f47e35c2eb"
      },
      {
        "id": "",
        "name": "6edb1fd609c7e011cd42656af67baf5271d8212933a8c964604d138306b9565f"
      },
      {
        "id": "",
        "name": "6606d6e6424f7c25b922905095ba8cbff83357430bf1ef0ce0553a411fed1748"
      },
      {
        "id": "",
        "name": "65967f471440449d2f1b615ff1338b8082b0481b617eda4d9f21a9f102b98859"
      },
      {
        "id": "",
        "name": "6503770b34c53025793f1674af87d80a8f6ed44b5780490796012a2b771b8f84"
      },
      {
        "id": "",
        "name": "61913e0a38282a42b26aff578da17dab60ac0fbee819fa42db5497cc5cf55760"
      },
      {
        "id": "",
        "name": "5d838c0dbf164b26c4c5dc20f96d3bf48a5f9fde88bbc1dd02c08007bb184d86"
      },
      {
        "id": "",
        "name": "5d0b2015998a8a5a2a60ebdd2f3d6a398e533d198b9157c1558e6913330c24ba"
      },
      {
        "id": "",
        "name": "5b497b4205427198fc922c74cad8275b4256579f8bb5a1f1dbad7151630288a0"
      },
      {
        "id": "",
        "name": "521869f9ee6066c33fb1615cbcad66de157876bd08cec05597e4d3a0405efac8"
      },
      {
        "id": "",
        "name": "59b416efff07208dc8b1c98a6f754e3abc14e55d71971ddc5581f6bc7ca45837"
      },
      {
        "id": "",
        "name": "44bfb9f0e13dd72ed111b5b5600b80b305ab153a0ee2224957e76391b28ac037"
      },
      {
        "id": "",
        "name": "42906ac10d053eec10c05e2eeebcb06a7d6b307dc0d18083151dff3e0ac70022"
      },
      {
        "id": "",
        "name": "4091ddc3560fb60bd3ef071367fd833d67c3c6e3e81165aa3d93519b93959658"
      },
      {
        "id": "",
        "name": "3d331e6c5c1b22377b3b4aba9f71d65a10a77df6d8ee64c3a0d7d7de3d1f1565"
      },
      {
        "id": "",
        "name": "3b8adf88b10e0c66d97b4909a17d4436a043ded5cf29c85ead22b58917e9ac7b"
      },
      {
        "id": "",
        "name": "381dc36504e1b319fde9bbae0a580da9f239b8af8066638f9a4203e58dc16087"
      },
      {
        "id": "",
        "name": "33e5e5e773d1909004d4b38a0e4e3e97e46cbdb7b17f94b28fce2c9ad0a375d3"
      },
      {
        "id": "",
        "name": "2e20ce7bc1e653737f05c910759fd2e420fe28f77f80a6d8e7c9346809e4dce7"
      },
      {
        "id": "",
        "name": "24aafe0a2033e2e5ca231ebca0e3c56740754a97ca1f5062305e6b30222fc0ee"
      },
      {
        "id": "",
        "name": "2496bfe15e283affdfcd7f1de9134227671e2cddfb726b46829fa966abb9ac96"
      },
      {
        "id": "",
        "name": "22cebb4f0fe6f4377e91b1e19204eff0f744d316b8c900377d8db4aa4f457801"
      },
      {
        "id": "",
        "name": "21a61777b0f725dd0dbdb2ecd0dd66e952012e94894e71c306059990c2afe377"
      },
      {
        "id": "",
        "name": "1cb60c7a121187978661b4bda84279f2324a5779b3f58bac11470a73fe544f6a"
      },
      {
        "id": "",
        "name": "1bb1187daff9610a0c142b48bc04d3e883344ca0eca8fe915d6a02fb3e7571ff"
      },
      {
        "id": "",
        "name": "18939c40dd601550da9f07d8115f4b19bec422df4ada9358bac9bd9e9ac94e94"
      },
      {
        "id": "",
        "name": "12e4817abc69918b8556a4f18371c803db3d5191031cb56f835ec33cdb12f0d9"
      },
      {
        "id": "",
        "name": "13f094d3eebe9d700360868006ac022a622ec606628adcc3782123d5092224d1"
      },
      {
        "id": "",
        "name": "03bc0ddfa59cfa290c426396f1c5fff45bd2c3ef90152cafc7c662c075dfc7d8"
      },
      {
        "id": "",
        "name": "08f965f640a3ec1c3aa9c31033455fad02550485d0d5b6fe33553d374775f18a"
      },
      {
        "id": "",
        "name": "02e98650e89146f0bddf29dd73165b9993d52f966d6194d375b6f0fcf737c38a"
      },
      {
        "id": "",
        "name": "02dba6f34480eac1d27c83a4ff06e3ba03fc63fcf3067e0957375bfd182ed39b"
      },
      {
        "id": "",
        "name": "01577f5b0869154fb678bcf86eef50afceb5fc189c87b2085fe5fcdf74cd6ff0"
      },
      {
        "id": "",
        "name": "2ec893440e04de55bc6bbe4b1db76df532aa42d3140a15dc5365ef520a1d4247"
      },
      {
        "id": "",
        "name": "0f7df7ac22957da6a793f641cda611c2c2a294355d4d19b29b6920853a012d98"
      }
    ],
    "malware": [
      {
        "id": "07267fd6-d853-4167-9f07-ae86fc4c1bda",
        "name": "BadIIS",
        "slug": "badiis"
      }
    ],
    "intrusion_sets": [
      {
        "id": "f4b027e8-379b-44a6-a873-675f06c2c517",
        "name": "Chinese-Speaking Group",
        "slug": "chinese-speaking-group"
      }
    ],
    "attack_patterns": [
      {
        "id": "28548897-8b18-4095-97e8-1732f52e9316",
        "name": "T1102.003"
      },
      {
        "id": "beaa4978-0309-438b-a45e-ec566b643811",
        "name": "T1505.003"
      },
      {
        "id": "e7d42089-23ed-495f-a2bc-c942c4e56fb7",
        "name": "T1573.002"
      },
      {
        "id": "16e4fc82-7c0b-4d1a-b784-b804b4df26dc",
        "name": "T1204.001"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "British Indian Ocean Territory"
      },
      {
        "id": "",
        "name": "Singapore"
      },
      {
        "id": "",
        "name": "Bangladesh"
      },
      {
        "id": "",
        "name": "India"
      },
      {
        "id": "",
        "name": "Taiwan"
      },
      {
        "id": "",
        "name": "Thailand"
      },
      {
        "id": "",
        "name": "Japan"
      },
      {
        "id": "",
        "name": "Philippines"
      },
      {
        "id": "",
        "name": "Brazil"
      },
      {
        "id": "",
        "name": "Technology"
      },
      {
        "id": "",
        "name": "Education"
      },
      {
        "id": "",
        "name": "Telecommunications"
      },
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://www.trendmicro.com/en_us/research/25/b/chinese-speaking-group-manipulates-seo-with-badiis.html",
    "https://otx.alienvault.com/pulse/67b31ac69d731dd2ad1013c8"
  ]
}