Hackers Hijacking IIS Servers Using Malicious BadIIS Module to Serve Malicious Content

Hackers are hijacking IIS servers with a native module called BadIIS that plugs directly into the IIS request pipeline, giving attackers full server privileges and enabling them to inspect and proxy traffic. Once deployed on compromised machines, BadIIS serves keyword-rich HTML to search engine crawlers, effectively poisoning indexing and redirecting legitimate users to scam or adult sites via a two‑phase flow.

Unit 42 observed the broader activity, noting links to ESET’s “Group 9” cluster and similarities with Cisco Talos’s “DragonRank” campaign. In March 2025, Unit 42 researchers uncovered an advanced SEO poisoning operation dubbed Operation Rewrite attributed to a Chinese‑speaking threat actor tracked as CL-UNK-1037.

The report also highlights three additional variants beyond BadIIS, including an ASP.NET Page Handler, a Managed .NET IIS Module, and an all‑in‑one PHP front‑controller, illustrating the threat actor’s adaptability across hosting environments. Mitigations proposed include monitoring IIS module registrations and tasks, plus leveraging security platforms such as Palo Alto Networks’ Advanced WildFire and Cortex XDR, with immediate incident response by Unit 42 advised for suspected compromises, according to Unit 42.