Tag: iis modules

2 Attack Reports | 0 Vulnerabilities

Attack reports

WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud and Monetization

A malware campaign called WEBJACK is compromising Microsoft IIS servers to deploy BadIIS malware modules for SEO poisoning and fraud. The attackers hijack high-profile targets, including government and educational institutions, to redirect users to gambling websites. The campaign uses various tools…

chinese threat actor

gambling redirection

Published: November 19, 2025

Downloadable IOCs: 34

Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign

A Chinese-speaking threat actor group, tracked as CL-UNK-1037, has been conducting a large-scale SEO poisoning campaign called Operation Rewrite. The attackers use a malicious IIS module named BadIIS to intercept and alter web traffic on compromised servers, manipulating search engine results to re…

chinese threat actor

chinese-speaking

operation rewrite

Published: September 25, 2025

Downloadable IOCs: 71

Click here to see more Attack Reports