DragonRank Targeting IIS Web Servers (Campaign)

Researchers have identified the DragonRank campaign targeting IIS web servers across Asia and Europe to deploy web shells (e.g., ASPXSpy) and malware (PlugX, BadIIS) for SEO poisoning, redirecting traffic and hijacking resources. The group exploits web application services (phpMyAdmin, WordPress) to gain footholds, uses DLL sideloading and SEH techniques to load PlugX (with XOR decryption key 0xD1), and employs tools like Mimikatz and PrintNotifyPotato for credential harvesting, lateral movement, and persistence across compromised IIS hosts.