Operation Rewrite: How a Malicious IIS Module Is Hijacking Websites

According to Unit 42, researchers uncovered a large-scale SEO poisoning campaign tracked as CL-UNK-1037 and dubbed Operation Rewrite, which uses a malicious IIS module named BadIIS to hijack websites and redirect users to scam content. BadIIS integrates directly into IIS servers, intercepting and modifying requests with full server privileges and can inject malicious JavaScript or iframes, act as a reverse proxy, hijack 302 redirects and steal sensitive information.

The operation unfolds in two phases: Phase 1 poisons lure content so search engine crawlers index poisoned pages, and Phase 2 activates when real users click those results, funneling them to attacker-controlled scam or betting sites. The report notes the nadrifty focus on Vietnam and Southeast Asia, with poisoned payloads referencing Vietnamese search engines such as Cốc Cốc and Timkhap and even ranking content tied to an illegal streaming term for a government entity.

It also identifies three additional BadIIS variants and connects the infrastructure to Group 9 and the DragonRank campaign, underscoring a state-linked approach to SEO poisoning at scale.