Loading story…
Cisco Talos reported that a BadIIS malware variant identified by embedded demo.pdb strings is being used as a commodity malware-as-a-service offering by multiple Chinese-speaking cybercrime groups. The IIS malware supports traffic redirection, reverse proxying, content hijacking, and backlink injection, enabling operators to monetize compromised web servers through SEO fraud and other web traffic abuse. Talos said the tooling has been under active development from at least September 2021 through January 2026, with customer-specific builds and feature changes that included antivirus evasion such as Norton bypass functionality.
Researchers also recovered a builder and related installer, dropper, and persistence components tied to the string lwxat, which Talos assesses is likely the developer alias behind the ecosystem. The tooling can deploy both 32-bit and 64-bit BadIIS modules, register them within IIS, and restore hidden backup copies after server restarts to maintain persistence. Activity was observed mainly across the Asia-Pacific region, with additional victims in South Africa, Europe, and North America, while Talos said the shared tooling strongly links the campaigns to the same developer even though attribution to a single threat actor remains difficult.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On publication, Talos disclosed its analysis of a BadIIS malware variant marked by embedded "demo.pdb" strings and described the recovered builder that generates customized IIS payloads and configurations. The report concluded with moderate confidence that the malware is a commodity IIS tool used by multiple Chinese-speaking cybercrime groups.
Cisco Talos reported BadIIS campaigns observed primarily in the Asia-Pacific region, with additional cases in South Africa, Europe, and North America. Despite strong links to the same tooling developer, Talos said attribution to a single threat actor remained difficult because multiple Chinese-speaking groups appeared to use the malware.
During the ecosystem's continued development, the malware gained evasion-oriented changes, including functionality intended to bypass Norton protections. These updates were part of the iterative refinement Talos observed across the BadIIS family.
Over the following years, the developer iteratively updated the BadIIS ecosystem with customer-specific builds, installers, droppers, persistence tools, and monetization-focused capabilities such as traffic redirection, reverse proxying, content hijacking, and backlink injection. Talos assessed with moderate confidence that the malware was being used by multiple Chinese-speaking cybercrime groups in a malware-as-a-service model.
Cisco Talos assessed that the BadIIS tooling family showed sustained development beginning at least in September 2021. The malware lineage was linked through embedded "demo.pdb" strings and related tooling associated with a likely developer using the alias "lwxat."
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos reported a **late-2025 to early-2026** campaign attributed to China-linked **UAT-8099** targeting vulnerable **Microsoft Internet Information Services (IIS)** servers across Asia, with a notable concentration in **Thailand and Vietnam**. The actor uses **web shells** and **PowerShell** to run scripts and deploy the **GotoHTTP** remote-access tool, and has also been observed using **SoftEther VPN** and **EasyTier** to maintain control of compromised servers. The intrusions are used to deploy **BadIIS**, a malware family associated with **black-hat SEO/SEO fraud** activity. Talos assessed the activity as having significant operational overlap with WithSecure’s **WEBJACK** campaign, citing correlations across **malware hashes**, **C2 infrastructure**, **victimology**, and even the **gambling sites** being promoted. Talos also described **new BadIIS variants** that hardcode the intended target region and include customized behaviors (e.g., specific file extensions and directory indexing configurations), and noted the existence of a **Linux ELF** BadIIS variant previously uploaded to VirusTotal that supports multiple modes (including proxy, injector, and SEO-fraud).
Jun 29, 2026
A Chinese-speaking cybercrime group, tracked as UAT-8099, has been identified targeting high-value Microsoft Internet Information Services (IIS) servers across multiple countries, including India, Thailand, Vietnam, Canada, and Brazil. The group’s primary objective is to conduct search engine optimization (SEO) fraud by manipulating search rankings through the compromise of reputable IIS servers. UAT-8099 leverages a variety of tools and techniques, including the deployment of BadIIS malware, web shells, open-source hacking utilities, and Cobalt Strike to maintain persistence and evade detection on compromised systems. The attackers use customized automation scripts to further obfuscate their activities and ensure continued access. Once inside a target server, the group exploits vulnerabilities to upload web shells, which are then used to collect sensitive information such as credentials, configuration files, logs, and certificate data. This stolen data is likely packaged for resale or used in further criminal operations. Cisco Talos researchers discovered several new BadIIS malware samples associated with this campaign, noting that some clusters had very low detection rates and others contained debug strings in simplified Chinese, indicating the group’s origin. The campaign has affected a diverse set of organizations, including universities, technology companies, and telecommunications providers, highlighting the group’s broad targeting strategy. UAT-8099’s operations are financially motivated, with a focus on monetizing both the manipulation of search engine results and the theft of valuable credentials. The group also utilizes Remote Desktop Protocol (RDP) to access and further exploit compromised IIS servers. The technical sophistication of the campaign is evident in the attackers’ ability to evade traditional security measures and maintain long-term persistence. The use of reputable, high-value servers for SEO fraud increases the impact of the campaign, as these servers are more likely to influence search engine rankings. The campaign demonstrates the ongoing threat posed by financially motivated cybercrime groups leveraging advanced malware and exploitation techniques. Security researchers recommend organizations running IIS servers implement robust monitoring, patch management, and incident response procedures to detect and mitigate such threats. The exposure of configuration files and certificates also raises concerns about potential follow-on attacks, including lateral movement and further credential abuse. The campaign’s discovery underscores the importance of threat intelligence sharing and proactive defense measures in protecting critical web infrastructure.
Jun 29, 2026
ReliaQuest disclosed a newly tracked espionage cluster, **OP-512**, that targeted internet-facing Microsoft IIS servers running outdated software, including a compromised **Windows Server 2016** host using unsupported **.NET Framework 4.0**. Investigators said the actor likely maintained access for roughly 75 days before returning to deploy a custom three-file web shell framework designed to produce cryptographically unique installations, obscure forensic timelines through timestomping, and report its location back to operators through hex-encoded DNS queries with HTTP fallback. The intrusion relied on layered evasion and persistence, including randomized variable names, junk code, **RSA** signature verification, **RC4** encryption, and malicious DLLs stored in the ASP.NET temporary directory. OP-512 also loaded multiple privilege-escalation tools directly into IIS process memory, including several from the **Potato Suite** and an undocumented utility dubbed **GhostKit**; even when endpoint protection terminated malicious processes, IIS worker process restarts allowed the tooling to reload. ReliaQuest assessed the cluster with moderate-high confidence as China-linked and potentially related in tradecraft to other IIS-focused operations, while urging defenders to retire or isolate legacy .NET servers, restrict script execution in upload paths, and remediate the original access vector rather than only removing web shells.
Jun 29, 2026