BadIIS Archives • Daily CyberSecurity

The Silent Hijack: BADIIS Malware Turns 1,800+ Servers into Illicit Websites BADIIS Malware IIS SEO Poisoning

The Silent Hijack: BADIIS Malware Turns 1,800+ Servers into Illicit Websites

Do Son February 16, 2026

A massive SEO poisoning campaign is silently turning legitimate web servers into billboards for the digital underground....

IIS Under Siege: UAT-8099 Deploys Region-Locked “BadIIS” & Linux Variants UAT-8099 BadIIS Malware Pacific Islands Forum Cyberattack

IIS Under Siege: UAT-8099 Deploys Region-Locked “BadIIS” & Linux Variants

Do Son February 2, 2026

A sophisticated cyber campaign targeting Internet Information Services (IIS) servers across Asia has evolved with new, highly...

UAT-8099: Chinese Group Uses BadIIS Malware on Compromised Servers for SEO Fraud and Credential Theft TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

UAT-8099: Chinese Group Uses BadIIS Malware on Compromised Servers for SEO Fraud and Credential Theft

Do Son October 3, 2025

Cisco Talos researchers have detailed the activities of UAT-8099, a Chinese-speaking cybercrime group leveraging compromised Microsoft IIS...

Operation Rewrite: How a Malicious IIS Module Is Hijacking Websites Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Operation Rewrite: How a Malicious IIS Module Is Hijacking Websites

Do Son September 23, 2025

Researchers at Unit 42 uncovered a large-scale search engine optimization (SEO) poisoning campaign, tracked as CL-UNK-1037 and...

BadIIS Malware : 35+ IIS Servers Compromised in DragonRank Campaign DragonRank - BadIIS malware

BadIIS Malware : 35+ IIS Servers Compromised in DragonRank Campaign

Do Son September 15, 2024

A recent report from Cisco Talos has exposed a new threat actor named DragonRank, a Chinese-speaking group...

Critical Alert 1 Active Exploit Detected Today

The Silent Hijack: BADIIS Malware Turns 1,800+ Servers into Illicit Websites

IIS Under Siege: UAT-8099 Deploys Region-Locked “BadIIS” & Linux Variants

UAT-8099: Chinese Group Uses BadIIS Malware on Compromised Servers for SEO Fraud and Credential Theft

Operation Rewrite: How a Malicious IIS Module Is Hijacking Websites

BadIIS Malware : 35+ IIS Servers Compromised in DragonRank Campaign