BADIIS
BadIIS is malware targeting Microsoft Internet Information Services (IIS) web servers. It is deployed as a malicious IIS module/native module that loads into the IIS worker process and intercepts HTTP traffic, allowing operators to silently redirect visitors from legitimate websites to illegal gambling, adult-content, and other illicit destinations while the site can appear normal to administrators and regular users. Reported functionality includes traffic redirection, reverse proxying for search-engine crawler manipulation, content hijacking, and backlink injection to support SEO fraud. Multiple reports describe split-view behavior in which search-engine crawlers receive keyword-stuffed or attacker-controlled content while normal users or administrators receive clean content; some variants also gate behavior on Referer, User-Agent, browser language, or Accept-Language values.
Cisco Talos assessed a prominent BadIIS variant, identifiable in part by embedded "demo.pdb" strings, as likely sold or shared among multiple Chinese-speaking cybercrime groups under a malware-as-a-service model. Talos linked sustained development from at least September 2021 through January 2026 to an author alias "lwxat" based on PDB strings and related tooling. Talos reported a builder that generates customized payloads, configuration files, JavaScript redirectors, and PHP backlink scripts, with support for traffic redirection, reverse proxying, content hijacking, and internal/external backlink injection. Recovered builds indicated customer-specific customization, including variants for Norton bypass, robots.txt hijacking, browser-language-based redirection, and a likely client-specific build for "x神"/"xshen." Related installers, droppers, and persistence tools copy payloads into IIS resource paths, register malicious modules, impersonate legitimate services or processes such as svchost.exe, FaxService, AudiosService, or a fake "Winlogin" service, and restore removed modules from hidden backups including C:\Windows\Logs after reboot. Talos also reported custom Base64 encoding, single-byte XOR obfuscation of C2 addresses, the user-agent string "lwxatisme," and artifacts including config.txt and module.txt. Published detections included ClamAV names such as Win.Malware.BadIIS-10069981-0, Win.Malware.BadIIS-10069988-0, Win.Malware.BadIIS-10069984-0, and Win.Malware.BadIIS-10069985-0, as well as Snort SIDs including 66400, 66439, 66438, 66399, 66398, 301498-1, and 301491.
Elastic Security Labs reported large-scale global SEO-poisoning campaigns involving BADIIS on more than 1,800 Windows IIS servers, with victims including government, corporate, educational, and financial organizations and a strong concentration in the Asia-Pacific region. Elastic linked observed activity to a Chinese-speaking cybercrime group it tracks as REF4033 and said it aligns with Cisco Talos reporting on UAT-8099. In a November 2025 intrusion at a multinational organization in Southeast Asia, Elastic observed deployment of BADIIS onto a Windows IIS server after post-compromise activity under w3wp.exe, creation of a local administrator account, and installation of a stealthy Windows service named WalletServiceInfo loading an unsigned ServiceDLL at C:\ProgramData\Microsoft\Windows\Ringtones\CbsMsgApi.dll. Elastic reported direct syscalls from the loaded module, staging of malicious files masquerading under C:\Windows\System32\drivers\ as WUDFPfprot.sys, WppRecorderpo.sys, and WppRecorderrt.sys, and modification of IIS configuration such as DefaultAppPool.config to load attacker modules including WsmRes64. Elastic also reported encrypted configuration URLs using SM4 ECB with key "1111111122222222" in newer samples and AES-128 ECB in older ones, plus infrastructure including gotz003[.]com, jbtz003[.]com, gotz001[.]com, and jbtz001[.]com, and analytics identifiers G-2FK43E86ZM, G-R0KHSLRZ7N, and Baidu Tongji ID B59ff1638e92ab1127b7bc76c7922245.
BadIIS has also been associated with Chinese-speaking cybercrime activity tracked as UAT-8099 and with overlap to WEBJACK. Reporting describes use of web shells, PowerShell, GotoHTTP, SoftEther VPN, EasyTier, OpenArk64, Sharp4RemoveLog, and CnCrypt Protect in IIS-server intrusions that culminate in BadIIS deployment for SEO fraud and gambling redirects. Talos reported region-specific BadIIS variants such as BadIIS IISHijack and BadIIS asdSearchEngine, including targeting focused on Vietnam and Thailand and XOR-obfuscated configuration or injected HTML using key 0x7A. Observed artifacts and pivots in related reporting include module names such as fashttp.dll, fasthttp.dll, cgihttp.dll, iis32, and iis64; hidden local accounts such as admin$, mysql$, admin1$, admin2$, and power$; and domains such as ashx.lhlsjcb[.]com in adjacent IIS-focused activity. Overall, the malware is used to monetize compromised IIS infrastructure through SEO poisoning, crawler manipulation, backlink injection, and selective redirection to gambling, adult, and fraudulent cryptocurrency destinations.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cisco Talos has uncovered a BadIIS variant — identifiable by its embedded "demo.pdb" strings — that functions as commodity malware.
Cisco Talos has uncovered a BadIIS variant — identifiable by its embedded "demo.pdb" strings — that functions as commodity malware.
"...alters SEO rankings using web shells, open-source hacking tools, Cobalt Strike, and various BadIIS malware..."
"...alters SEO rankings using web shells, open-source hacking tools, Cobalt Strike, and various BadIIS malware..."
Elastic Security Labs observes large-scale SEO poisoning campaigns targeting IIS servers with BADIIS malware globally, impacting over 1,800 Windows servers.
Techniques & procedures
22 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
2 techniques"BadIIS Malware Spreads via SEO Poisoning"; "HiddenGh0st, Winos and kkRAT Exploit SEO"
"UAT-8099 manipulates search rankings..."; "Threat actors are leveraging SEO poisoning and malicious advertisements to trick users into downloading backdoored versions of Microsoft Teams..."
Initial Access
1 technique"Once a vulnerable IIS server is found – either via security vulnerability or weak settings in the web server's file upload feature – the threat actor uses the foothold to upload web shells..."
Execution
2 techniquesThese fully-formed commands are then executed, likely via cmd.exe /c, using a function designed to capture the command output.
Persistence
3 techniques"BadIIS ... Plants Web Shells"; "GhostRedirector ... native Internet Information Services (IIS) module"
...compromised more than 1,800 Windows web servers worldwide using a malicious IIS module called BADIIS... Techniques: Server Software Component: IIS Components
Privilege Escalation
2 techniquesContent Hijacking: Modifying target title, description, and keyword (TDK) metadata at a configurable percentage rate to silently piggyback off the victim site’s domain authority.
Stealth
7 techniquesThe malware uses custom Base64 encoding and single-byte XOR obfuscation to conceal command-and-control server addresses from security scanners.
These installers copy the payloads straight into native IIS resource trees—impersonating trusted core processes like svchost.exe or FaxService.
...stages three files masquerading within the System32\drivers folder... The malware uses the CopyFileA function to move the contents from the masqueraded files into the .NET directory... Techniques: Masquerading: Match Legitimate Name or Location
Content Hijacking: Modifying target title, description, and keyword (TDK) metadata at a configurable percentage rate to silently piggyback off the victim site’s domain authority.
The tool employs a custom parsing routine to segment the file based on these tags... Using this extracted data, the malware dynamically assembles command-line instructions... These fully-formed commands are then executed...
the persistent Windows service automatically extracts a fresh copy from a hidden backup directory (C:\Windows\Logs) upon the next server restart
Credential Access
2 techniquesFor search engine crawlers, BadIIS acts as a reverse proxy, fetching illicit content from the attacker’s command-and-control backend and serving it as though it belongs to the legitimate website.
"UAT-8099... theft of high-value credentials, configuration files, and certificate data."
Collection
1 techniqueCommand and Control
5 techniquesThe malware uses custom Base64 encoding and single-byte XOR obfuscation to conceal command-and-control server addresses from security scanners.
Reverse Proxying: Intentionally intercepting search engine crawlers. When a crawler arrives, the malware acts as a reverse proxy, silently pulling black-hat SEO spam data from the attacker’s backend and rendering it to the search engine to manipulate public rankings.
enabling capabilities including traffic redirection to illicit sites, reverse proxying for search engine crawler manipulation, content hijacking, and backlink injection for malicious search engine optimization (SEO) fraud
The builder allows threat actors to input target URLs, typically JavaScript-based redirectors, designed to be injected into the victim's browser. This feature forcibly redirects legitimate user traffic to spam infrastructure, such as illegal gambling, adult content, or other malicious websites.
Another tool acts as a module initialization dropper, packaging the malicious DLL payloads within a standalone executable labeled “IIS32” and “IIS64” inside its resources.
Impact
1 techniqueThe builder facilitates a diverse menu of illicit capabilities: Traffic Redirection: Forcibly hijacking legitimate consumer browser traffic and routing it directly to underground spam infrastructure, illegal gambling arenas, or adult content platforms.
Recent activity
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware used to infect Microsoft IIS servers; described as a shared variant used by multiple Chinese-speaking cybercrime groups.
BadIIS is an IIS server malware toolkit operated under a malware-as-a-service model. It hijacks web server traffic, performs reverse proxying for search engine crawlers, injects PHP backlinks, modifies site metadata for SEO abuse, and redirects visitors to spam, gambling, or adult-content infrastructure. It also uses persistent Windows service installers and hidden backups to survive removal.
BadIIS is malware targeting IIS web servers by installing a malicious IIS module that intercepts and manipulates web traffic. It redirects visitors to illicit destinations, reverse proxies content for search engine crawler manipulation, hijacks website content, injects backlinks for SEO fraud, and uses auxiliary installer, dropper, and persistence tools to maintain access. The report assesses the discussed variant as likely operating in a Malware-as-a-Service model.
An IIS malware/backdoor offered under a MaaS model with builder support for traffic redirection, reverse proxying for crawler manipulation, content hijacking, and backlink injection for malicious SEO fraud.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.