Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign

Summary: Unit 42 uncovered in March 2025 an SEO poisoning campaign it calls Operation Rewrite, tracked as CL-UNK-1037 and attributed with high confidence to a Chinese-speaking threat actor. The campaign uses a malicious native IIS module called BadIIS, which intercepts and alters web traffic on compromised servers, acts as a reverse proxy, and serves malicious content to visitors, with configuration showing a geographic focus on East and Southeast Asia including Vietnamese search engines.

Why it matters: Attackers compromised established, legitimate websites - including a government entity in Southeast Asia - to rank for queries like an illegal soccer streaming search, exploiting domain reputation that security teams already trust. The toolkit extends beyond native IIS modules to ASP.NET page handlers, managed .NET IIS modules and a PHP script, so checking for a single implant type will not cover the campaign.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related