From PDB strings to MaaS: Tracking a commodity BadIIS ecosystem used by Chinese-speaking threat
Summary: Cisco Talos reports that since 2024 it has investigated attacks across the Asia-Pacific region, plus a few in South Africa, Europe and North America, using a BadIIS variant marked by "demo.pdb" strings, which it assesses with moderate confidence is a commodity tool used by multiple Chinese-speaking cybercrime groups. PDB paths from the variants show a build environment on "Administrator\Desktop" with Chinese-language folder names and date-based versioning, tracing development from at least Sept. 30, 2021 through a compilation dated Jan. 6, 2026.
Bottom line: The build folders name the developer's own priorities - "bypass Norton," Baidu browser compatibility with robots.txt hijacking, and a "dll-no503" fix so infected IIS servers don't throw errors that would alert administrators - meaning the tool is maintained specifically to stay invisible on your servers. Talos also recovered a "version 1.0" builder that generates config files, JavaScript redirectors and PHP backlink scripts, and assesses a modular MaaS model in which buyers can request bespoke modules from the developer.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026