BadIIS Malware Abuses IIS Servers For Malicious Traffic Redirection

The report details the BadIIS campaign: a commercially sold IIS-targeting malware ecosystem used globally (primarily Asia‑Pacific) for traffic redirection, reverse-proxying to manipulate search-engine indexing, content hijacking, and SEO manipulation. Researchers mapped a development timeline via embedded PDB strings (Sept 2021–Jan 2026); the malware is distributed via a builder (MaaS) allowing custom payloads, and uses two-stage installers, C2 authentication, service impersonation, backup persistence, and AV-bypass techniques.