CyberHappenings logo
☰
🏠 Home 📂 Browse ℹ️ About

Track cybersecurity events as they unfold. Sourced timelines, daily updates. Fast, privacy‑respecting. No ads, no tracking.

BadIIS Malware SEO Poisoning Campaign Targets East and Southeast Asia

First reported
Last updated
📰 1 unique sources, 1 articles

Summary

Hide ▲

A Chinese-speaking threat actor, dubbed CL-UNK-1037, is conducting an SEO poisoning campaign using the BadIIS malware. The campaign targets East and Southeast Asia, particularly Vietnam, to redirect web traffic and plant web shells on compromised servers. The malware manipulates search engine results to direct users to malicious sites, leveraging compromised legitimate servers. The actor shares infrastructure and architectural overlaps with Group 9 and has been active since at least 2025. The BadIIS malware intercepts and modifies HTTP traffic to serve malicious content, using compromised IIS servers to alter search engine indexing. The campaign involves creating new user accounts, dropping web shells, and exfiltrating source code to maintain persistent access. The threat actor employs multiple variants of BadIIS, including ASP.NET page handlers, .NET IIS modules, and PHP scripts, to achieve SEO poisoning and traffic manipulation.

Timeline

  1. 23.09.2025 11:13 📰 1 articles · ⏱ 2h ago

    BadIIS Malware SEO Poisoning Campaign Targets East and Southeast Asia

    A Chinese-speaking threat actor, identified as CL-UNK-1037, is conducting an SEO poisoning campaign using the BadIIS malware. The campaign targets East and Southeast Asia, particularly Vietnam, to redirect web traffic and plant web shells on compromised servers. The malware manipulates search engine results to direct users to malicious sites, leveraging compromised legitimate servers. The actor shares infrastructure and architectural overlaps with Group 9 and has been active since at least 2025. The BadIIS malware intercepts and modifies HTTP traffic to serve malicious content, using compromised IIS servers to alter search engine indexing. The campaign involves creating new user accounts, dropping web shells, and exfiltrating source code to maintain persistent access. The threat actor employs multiple variants of BadIIS, including ASP.NET page handlers, .NET IIS modules, and PHP scripts, to achieve SEO poisoning and traffic manipulation.

    Show sources
    Open in new tab

Information Snippets