DragonRank
DragonRank is a threat cluster associated with malicious activity targeting Microsoft IIS web servers. Reporting cited in the content places it among China-linked or Chinese-speaking clusters that have singled out IIS servers, and Talos notes that BadIIS malware has been used by multiple Chinese-speaking threat clusters including DragonRank. The group is associated with BadIIS-style operations that turn compromised IIS servers into assets for search engine manipulation and SEO fraud. The content also notes that DragonRank reporting includes PlugX. Public reporting referenced here distinguishes DragonRank from other IIS-focused clusters such as UAT-8099/WEBJACK, Operation Rewrite (CL-UNK-1037), GhostRedirector, and OP-512: DragonRank is described as adjacent or similar in tradecraft, but not identical based on currently published evidence, and a low-confidence connection to CL-UNK-1037 is noted due to similarity without infrastructure overlap. No additional confirmed aliases or sub-groups are provided in the content beyond the name DragonRank.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- CN
Tradecraft
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
China-aligned threat group observed targeting IIS web servers.
Cybercrime group using BadIIS variants to compromise web servers for search engine manipulation and SEO fraud.
Distinct but related IIS SEO-manipulation cluster in the BadIIS ecosystem; differentiated in reporting by inclusion of PlugX and other campaign-specific artifacts and patterns; sometimes discussed as a service-provider-like operation around SEO manipulation.
Chinese-speaking threat cluster associated (in this reporting) with use of BadIIS malware for IIS-based SEO fraud/traffic manipulation.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.