BADIIS

T1588.002 — Obtain Capabilities: Tool (Resource Development)

Elastic Security Labs observed post-compromise activity from a Windows IIS server from an unknown attack vector; the ATT&CK mapping includes Exploit Public-Facing Application.

Persistance via tâche planifiée nommée Google Chrome Start

The attack uses multiple Windows batch scripts to carry out its objectives.

the script modifies the Windows Registry and uses PowerShell to add specific directories to the Windows Defender exclusion list

File name back.bat Alternate name for the main Windows deployment script File name bai.bat Secondary batch script used for backdoor execution and persistence File name user.bat Script used to create a privileged local account

BadIIS works by planting a malicious module inside the IIS server software that runs quietly in the background.

Persistance via tâche planifiée nommée Google Chrome Start

uses PowerShell to add specific directories to the Windows Defender exclusion list ... reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"

This SEO hijacking web handler silently takes over an IIS application's request pipeline via reflection.

Select instances entail the deployment of a web shell, which then paves the way for BadIIS and additional backdoors for persistent access.

The malicious DLL stages the BADIIS IIS native modules and alters the IIS configuration to load them into the request pipeline of the DefaultAppPool.

If an antivirus solution flags and removes the active hooking module, the persistent Windows service automatically extracts a fresh copy from a hidden backup directory (C:\Windows\Logs) upon the next server restart, ensuring durable, long-term survival.

Persistance via tâche planifiée nommée Google Chrome Start

Content Hijacking: Modifying target title, description, and keyword (TDK) metadata at a configurable percentage rate to silently piggyback off the victim site’s domain authority.

If an antivirus solution flags and removes the active hooking module, the persistent Windows service automatically extracts a fresh copy from a hidden backup directory (C:\Windows\Logs) upon the next server restart, ensuring durable, long-term survival.

The malware uses custom Base64 encoding and single-byte XOR obfuscation to conceal command-and-control server addresses from security scanners.

These installers copy the payloads straight into native IIS resource trees—impersonating trusted core processes like svchost.exe or FaxService.

During this attack, the threat actor stages three files masquerading within the System32\drivers folder.

Content Hijacking: Modifying target title, description, and keyword (TDK) metadata at a configurable percentage rate to silently piggyback off the victim site’s domain authority.

the script attempts to delete its initial staging files and scripts to cover its tracks and hinder forensic analysis

the persistent Windows service automatically extracts a fresh copy from a hidden backup directory (C:\Windows\Logs) upon the next server restart

BadIIS works by planting a malicious module inside the IIS server software that runs quietly in the background.

uses PowerShell to add specific directories to the Windows Defender exclusion list ... reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"

For search engine crawlers, BadIIS acts as a reverse proxy, fetching illicit content from the attacker’s command-and-control backend and serving it as though it belongs to the legitimate website.

Webroot enumeration: dir C:\inetpub\wwwroot\ -Name reveals deployed applications

For search engine crawlers, BadIIS acts as a reverse proxy, fetching illicit content from the attacker’s command-and-control backend and serving it as though it belongs to the legitimate website.

the web shell is transmitted to “up.ashx” via an HTTP POST request

Upon initialization, the module downloads content from URLs defined in its configuration... Each URL in the configuration points to a static .txt file that contains a second-stage resource.

Reverse Proxying: Intentionally intercepting search engine crawlers. When a crawler arrives, the malware acts as a reverse proxy, silently pulling black-hat SEO spam data from the attacker’s backend and rendering it to the search engine to manipulate public rankings.

enabling capabilities including traffic redirection to illicit sites, reverse proxying for search engine crawler manipulation, content hijacking, and backlink injection for malicious search engine optimization (SEO) fraud

The builder allows threat actors to input target URLs, typically JavaScript-based redirectors, designed to be injected into the victim's browser. This feature forcibly redirects legitimate user traffic to spam infrastructure, such as illegal gambling, adult content, or other malicious websites.

Using a batch script that employs certutil to download a privilege escalation tool ("EfsPotato"), a secondary batch script, and Quasar RAT from a remote server

The builder facilitates a diverse menu of illicit capabilities: Traffic Redirection: Forcibly hijacking legitimate consumer browser traffic and routing it directly to underground spam infrastructure, illegal gambling arenas, or adult content platforms.

They also used scripts to raise privileges, weaken endpoint scanning around IIS folders, create high-privilege access, and retain control after the original break-in.