BadIIS Malware Spreads via SEO Poisoning — Redirects Traffic, Plants Web Shells

Cybersecurity researchers have spotlighted an SEO poisoning campaign, dubbed Operation Rewrite, in which a Chinese-speaking threat actor uses a malware named BadIIS to hijack search results and drive traffic to compromised sites in East and Southeast Asia, with a focus on Vietnam.

According to Palo Alto Networks Unit 42, the attacker injects manipulated content into legitimate websites so that the compromised site ranks for terms chosen by the command-and-control server response, effectively turning the site into a reverse proxy. The BadIIS IIS module can detect visitors from search engine crawlers and fetch poisoned content from an external server to alter SEO, redirecting users to scam sites when they click on results.

In one observed incident, the attackers allegedly used access to a search engine crawler to pivot to other systems, create new local user accounts, and drop web shells to establish persistent remote access and exfiltrate source code. The disclosure notes overlaps with Group 9 infrastructure and links to GhostRedirector, a separate threat cluster detailed by ESET.