The art of being ungovernable
Summary: Cisco Talos discovered a commodity BadIIS malware variant, identifiable by embedded "demo.pdb" strings, that fuels a malware-as-a-service ecosystem for Chinese-speaking cybercrime groups and is used for SEO fraud, server content hijacking, and traffic redirection. The same newsletter roundup cites a researcher finding a public CISA GitHub repository containing 844MB of sensitive data including plain-text passwords and authentication tokens, and an NYC Health + Hospitals breach affecting at least 1.8 million people that included stolen fingerprints and palm prints.
Why it matters: The BadIIS toolset is sold as a commodity and its author pushes rapid updates to evade specific security vendors, so the barrier to entry drops while silent server traffic hijacking spreads; defenders are told to watch IIS environments for unexpected reverse proxying, traffic redirection, and spikes in 503 errors. Separately, biometric data stolen from 1.8 million people at NYC Health + Hospitals cannot be replaced for life.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026