Larva-25003: IIS Native Module Malware Used in Targeted Web Server Attacks (Campaign)

Larva-25003 is a targeted campaign attributed to Chinese-speaking actors that compromised poorly secured Microsoft IIS servers in South Korea by registering a malicious native IIS module (via appcmd.exe) to intercept and modify web traffic for redirects, phishing pages, and affiliate monetization. The intruders used a fileless .NET loader to execute webshells in memory, deployed Gh0st RAT for full remote control, and leveraged a custom rootkit (HijackDriverManager) to hide components, blending espionage with monetization tactics.