DragonRank, a Chinese-speaking SEO manipulator service provider
ID: c33d2433-b36e-5e9e-851d-f079d898bf50
STIX ID: report--c33d2433-b36e-5e9e-851d-f079d898bf50
Feed Name: Cisco Talos
Cisco Talos describes "DragonRank," a Simplified Chinese-speaking cybercriminal group conducting a cross-border black-hat SEO manipulation campaign that compromises Windows IIS servers to implant BadIIS (IIS proxy/SEO fraud) and PlugX backdoors; attackers use web shells, credential-dumping tools (Mimikatz, BadPotato variants), DLL sideloading with SEH techniques, lateral movement, and persistence to host and promote scam sites across multiple industries and countries, with over 35 confirmed compromised servers and published IOCs.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.