Dragon Rank, a Chinese-speaking SEO manipulator service provider
Summary: Cisco Talos uncovered a cluster it calls DragonRank, tied to Simplified Chinese-speaking actors, that compromises Windows IIS servers hosting corporate websites to implant the BadIIS malware and manipulate search engine crawlers. Talos confirmed more than 35 IIS servers compromised across Thailand, India, Korea, Belgium, the Netherlands and China, with initial access gained through vulnerabilities in phpMyAdmin, WordPress and similar web applications, followed by an ASPXspy web shell, PlugX, and credential-dumping tools including Mimikatz, PrintNotifyPotato, BadPotato and GodPotato.
What's compelling: Five months after the initial breach, DragonRank returned to one compromised IIS server, added a hidden administrator account named "admin$", re-enabled RDP, then deleted the account to cover its tracks - a dwell time and cleanup discipline that most incident response timelines are not built to catch.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026