WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud and Monetization

Description

A malware campaign called WEBJACK is compromising Microsoft IIS servers to deploy BadIIS malware modules for SEO poisoning and fraud. The attackers hijack high-profile targets, including government and educational institutions, to redirect users to gambling websites. The campaign uses various tools from the Chinese cybercriminal ecosystem, suggesting a Chinese-speaking threat actor. The malicious IIS modules selectively serve content to search engine crawlers while redirecting or blocking ordinary visitors. The operation spans multiple countries, primarily in Southeast Asia and Latin America, with a focus on Vietnamese-language targeting. The campaign demonstrates the evolving nature of IIS hijacking and the growing trend of leveraging legitimate security tools for malicious purposes.