IIS servers owned by RudePanda like it's 2003
Essential information
- Published
- 22/10/2025 19:02
- Modified
- 22/10/2025 20:20
- Tags
- 2025-10-22 asp .net cryptocurrency hijackdrivermanager hijackserver iis remote command execution rootkit seo wingtbcli
- Related entities
- 36 observables, 1 intrusion sets (apt), 16 techniques (mitre), 3 malware
Description
A new malicious IIS module called 'HijackServer' has been detected compromising IIS servers by exploiting exposed ASP .NET machine keys. The attackers use a customized rootkit and ready-made tools to gain persistent access. While primarily aimed at search engine optimization for cryptocurrency scams, the module allows unauthenticated remote command execution on affected servers. Hundreds of servers worldwide have been compromised. The operation shows determination and capability, though possibly relying on low-skilled operators. The threat leaves servers vulnerable to exploitation by any third party for espionage or malicious infrastructure development.