BADIIS Malware Targets Over 1,800 Windows Servers in Massive SEO Poisoning Attack
ID: 052bbdb3-43cf-508e-812b-0d6f00e1350e
STIX ID: report--052bbdb3-43cf-508e-812b-0d6f00e1350e
Feed Name: GBHackers
Threat Score
Elastic Security Labs tracked REF4033, a large-scale BADIIS-driven SEO poisoning campaign that has compromised over 1,800 Windows IIS servers worldwide (notably in APAC) by deploying a malicious IIS module via web shells, creating persistent services, and modifying IIS configuration to serve attacker-controlled SEO content and geo-targeted redirects to illicit gambling, adult, and crypto scam sites.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.