BadIIS Strikes: DragonRank’s Sneaky SEO Scam Hits IIS Servers in Asia
Threat actors are targeting IIS servers in Asia with a campaign to install BadIIS malware. This SEO manipulation scam redirects users to shady gambling sites, proving that even hackers are trying to make a quick buck. Watch out for DragonRank, a group that makes SEO fraud look as easy as pie!
Hot Take:
***Oh, the irony of hackers using SEO for something other than optimizing cat memes. Who knew IIS servers could double as gambling promoters? Sounds to me like the hackers are just trying to bankroll their next Vegas vacation, one compromised server at a time!***
Key Points:
– Cybercriminals are targeting IIS servers in Asia to install BadIIS malware and manipulate SEO.
– The attack is financially motivated, redirecting users to illegal gambling sites.
– DragonRank, a Chinese-speaking group, is suspected behind the campaign, linked to Group 9 and Group 11.
– BadIIS malware alters HTTP response headers to redirect users based on certain keywords.
– The Funnull CDN is involved in infrastructure laundering, using IPs from AWS and Azure for criminal activities.