Loading story…
ESET disclosed IISpy, a previously undocumented server-side backdoor built as a malicious native module for Microsoft Internet Information Services (IIS), enabling long-term espionage on compromised web servers. The implant has reportedly been active since at least July 2020 and likely reaches victims through exploitation of a server-side vulnerability, with operators also observed using Juicy Potato to gain the administrative privileges required to install the module. Telemetry identified affected IIS servers in Canada, the United States, and the Netherlands, although researchers said the true scope is likely larger because many servers do not run security software.
Once installed, IISpy passively inspects inbound HTTP requests and waits for specially crafted attacker traffic, then executes encrypted commands and hides encrypted responses inside fake PNG images returned by the server. By abusing IIS native-module functionality documented in Microsoft's native-code API, the malware integrates directly into web-server processing while using anti-forensic features to rewrite or strip request data before it is logged. That behavior causes malicious activity to appear in IIS logs as benign GET requests to the root path, complicating detection and incident response.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
ESET reported that the previously undocumented IIS backdoor IISpy had been active since at least July 2020 on compromised Microsoft IIS web servers. The malware was described as a server-side implant used for long-term espionage.
ESET discovered and analyzed IISpy, a malicious native IIS module that inspects inbound HTTP requests, executes encrypted commands, and hides responses inside fake PNG images. The company also documented anti-forensic logging manipulation and telemetry showing affected servers in Canada, the United States, and the Netherlands.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs reported a **global SEO poisoning operation** compromising Windows **IIS** web servers using a malicious IIS module dubbed **BADIIS**, attributed to a Chinese-speaking cybercrime group tracked as **REF4033** and aligned with Cisco Talos’ **UAT-8099**. The activity observed in an intrusion at a multinational organization in Southeast Asia matches prior public reporting and is assessed to have impacted **1,800+ Windows servers** across multiple sectors (including government, corporate, and education) in countries spanning Asia-Pacific, Europe, and Latin America. The operation uses a two-phase workflow: serving keyword-stuffed content to search engine crawlers to manipulate rankings, then redirecting real users to monetization destinations in the “vice economy,” including **online gambling**, pornography, and cryptocurrency schemes. Additional research emphasized that multiple vendors are labeling overlapping slices of the same IIS SEO-fraud ecosystem differently, and recommended consolidating hunting for **UAT-8099/WEBJACK**-style activity based on shared indicators and behaviors. Defensive guidance focused on detecting **new/unknown IIS module registrations** and suspicious DLL/module naming and staging patterns (e.g., `fashttp/fasthttp/cgihttp/iis32/iis64`-style DLLs; staging under paths like `Desktop\VN`, `Desktop\newth`, `Public\Videos`), correlating anomalous local account creation patterns (e.g., **`$`-suffixed accounts**) and remote-access tooling on web servers, and using **HTTP differential-response probing** (varying `User-Agent`, `Referer`, `Accept-Language`) to identify cloaking behavior used to selectively serve crawler vs. user content.
Jun 29, 2026
Cisco Talos reported that a **BadIIS** malware variant identified by embedded `demo.pdb` strings is being used as a commodity **malware-as-a-service** offering by multiple Chinese-speaking cybercrime groups. The IIS malware supports traffic redirection, reverse proxying, content hijacking, and backlink injection, enabling operators to monetize compromised web servers through **SEO fraud** and other web traffic abuse. Talos said the tooling has been under active development from at least September 2021 through January 2026, with customer-specific builds and feature changes that included antivirus evasion such as Norton bypass functionality. Researchers also recovered a builder and related installer, dropper, and persistence components tied to the string `lwxat`, which Talos assesses is likely the developer alias behind the ecosystem. The tooling can deploy both 32-bit and 64-bit BadIIS modules, register them within IIS, and restore hidden backup copies after server restarts to maintain persistence. Activity was observed mainly across the Asia-Pacific region, with additional victims in South Africa, Europe, and North America, while Talos said the shared tooling strongly links the campaigns to the same developer even though attribution to a single threat actor remains difficult.
Jun 29, 2026
ESET disclosed a previously undocumented malware family, **IIStealer** (`Win64/BadIIS`), that compromises Microsoft IIS web servers and steals payment-card and other checkout data from e-commerce sites. The malware is implemented as a malicious **native IIS module**, allowing it to load inside the IIS worker process, intercept inbound HTTP `POST` requests sent to hardcoded checkout paths, and capture request bodies containing customer payment information and other transaction details. Because IIStealer runs on the server after HTTPS traffic has already been decrypted, it can bypass the protection shoppers expect from SSL/TLS and harvest data directly during transaction processing. ESET observed the threat on a small number of U.S.-based IIS servers between September 2020 and January 2021, with the malware storing stolen data locally and later exfiltrating it through specially crafted HTTP requests to the compromised server; in some cases it masqueraded as a legitimate IIS component under the filename `dir.dll`, highlighting how native IIS extensibility can be abused for persistent, hard-to-detect server-side skimming.
Aug 14, 2026