Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign

In March 2025, Unit 42 uncovered a wide-scale SEO poisoning campaign dubbed “Operation Rewrite,” driven by a Chinese-speaking threat actor, with infrastructure and techniques overlapping with the Group 9 cluster and connections to DragonRank. The campaign centres on BadIIS, a native IIS module that intercepts HTTP requests, manipulates content and serves poisoned pages via a reverse proxy, aiming to trick search engines and redirect victims to scam sites.

The attackers focus their activity on East and Southeast Asia, with a configuration listing regional search engines and Vietnamese terms to guide targeting. The operation unfolds in two phases: first luring search engines by having their crawlers index poisoned content, then triggering a redirection trap to route visitors to malicious sites.

Analysts describe several variants beyond BadIIS, including ASP.NET, a managed IIS module and an all-in-one PHP script, all designed to poison search results and control traffic. According to Unit 42, the threat actors’ linguistic artefacts and shared C2 infrastructure underpin the high-confidence assessment of a Chinese-speaking attribution and links to Group 9, with occasional parallels to DragonRank.