DragonRank Exploits IIS Servers with BadIIS Malware for SEO Fraud and Gambling Redirects - Related to malware, x, badiis, magento, gambling

DragonRank Exploits IIS Servers with BadIIS Malware for SEO Fraud and Gambling Redirects

Threat actors have been observed targeting Internet Information Services (IIS) servers in Asia as part of a search engine optimization (SEO) manipulation campaign designed to install BadIIS malware.

"It is likely that the campaign is financially motivated since redirecting people to illegal gambling websites presents that attackers deploy BadIIS for profit," Trend Micro researchers Ted Lee and Lenart Bermejo noted in an analysis ,.

Targets of the campaign include IIS servers located in India, Thailand, Vietnam, Philippines, Singapore, Taiwan, South Korea, Japan, and Brazil. These servers are associated with government, universities, technology companies, and telecommunications sectors.

Requests to the compromised servers can then be served altered content from attackers, ranging from redirections to gambling sites to connecting to rogue servers that host malware or credential harvesting pages.

It's suspected that the activity is the work of a Chinese-speaking threat group known as DragonRank, which was documented by Cisco Talos last year as delivering the BadIIS malware via SEO manipulation schemes.

The DragonRank campaign, in turn, is introduced to be associated with an entity referred to as Group 9 by ESET in 2021 that leverages compromised IIS servers for proxy services and SEO fraud.

Trend Micro, however, noted that the detected malware artifacts share similarities with a variant used by Group 11, featuring two different modes for conducting SEO fraud and injecting suspicious JavaScript code into responses for requests from legitimate visitors.

"The installed BadIIS can alter the HTTP response header information requested from the web server," the researchers noted. "It checks the 'User-Agent' and 'Referer' fields in the received HTTP header."

"If these fields contain specific search portal sites or keywords, BadIIS redirects the user to a page associated with an online illegal gambling site instead of a legitimate web page."

The development comes as Silent Push linked the China-based Funnull content delivery network (CDN) to a practice it calls infrastructure laundering, in which threat actors rent IP addresses from mainstream hosting providers such as Amazon Web Services (AWS) and Microsoft Azure and use them to host criminal websites.

Funnull is mentioned to have rented over 1,200 IPs from Amazon and nearly 200 IPs from Microsoft, all of which have since been taken down. The malicious infrastructure, dubbed Triad Nexus, has been found to fuel retail phishing schemes, romance baiting scams, and money laundering operations via fake gambling sites.

"But new IPs are continually being acquired every few weeks," the business expressed. "Funnull is likely using fraudulent or stolen accounts to acquire these IPs to map to their CNAMEs."

Threat actors have been observed exploiting multiple security flaws in various software products, including Progress Telerik UI for [website] AJAX and A......

Apple has released emergency security updates to patch a zero-day vulnerability that the firm says was exploited in targeted and.

​Microsoft revealed over the weekend that it has expanded its Microsoft Copilot (AI) bug bounty program and increased payouts for moderate severity v......

Hackers Exploit Google Tag Manager to Deploy Credit Card Skimmers on Magento Stores

Threat actors have been observed leveraging Google Tag Manager (GTM) to deliver credit card skimmer malware targeting Magento-based e-commerce websites.

Website security corporation Sucuri mentioned the code, while appearing to be a typical GTM and Google Analytics script used for website analytics and advertising purposes, contains an obfuscated backdoor capable of providing attackers with persistent access.

As of writing, as many as three sites have been found to be infected with the GTM identifier (GTM-MLHK2N68) in question, down from six . GTM identifier refers to a container that includes the various tracking codes ([website], Google Analytics, Facebook Pixel) and rules to be triggered when certain conditions are met.

Further analysis has revealed that the malware is being loaded from the Magento database table "cms_block.content," with the GTM tag containing an encoded JavaScript payload that acts as a credit card skimmer.

"This script was designed to collect sensitive data entered by people during the checkout process and send it to a remote server controlled by the attackers," security researcher Puja Srivastava presented.

Upon execution, the malware is designed to pilfer credit card information from the checkout pages and send it to an external server.

This is not the first time GTM has been abused for malicious purposes. In April 2018, Sucuri revealed that the tool was being leveraged for malvertising purposes.

The development comes weeks after the organization detailed another WordPress campaign that likely employed vulnerabilities in plugins or compromised admin accounts to install malware that redirected site visitors to malicious URLs.

Apple has released emergency security updates to patch a zero-day vulnerability that the organization says was exploited in targeted and.

Vergangene Weihnachten wurde ein Problem mit Windows 11 24H2-Installationen bekannt, dass diese keine weiteren Aktualisierungen installieren können, w......

Lee Enterprises, one of the largest newspaper groups in the United States, says a cyberattack that hit its systems caused an outage last week and impa......

Hacker pleads guilty to SIM swap attack on US SEC X account

Today, an Alabama man pleaded guilty to hijacking the [website] Securities and Exchange Commission (SEC) account on X in a January 2024 SIM swapping attack.

This comes after the defendant, 25-year-old Eric Council Jr., first pleaded not guilty to hacking the account and enabling his co-conspirators to make a fake announcement that Bitcoin ETFs were approved.

"Today the SEC grants approval to Bitcoin ETFs for listing on registered national security exchanges. The approved Bitcoin ETFs will be subject to ongoing surveillance and compliance measures to ensure continued investor protection," read the fake post on X.

Council's fraudulent post caused Bitcoin to jump up in price by $1,000 and just as quickly plummetted by $2,000 after SEC Chairperson Gary Gensler tweeted that the SEC account had been hijacked and the Bitcoin ETF approval announcement was fake.

Tweet from hacked SEC X account (BleepingComputer).

​The SEC confirmed the next day that the @SECGov X account was compromised through a SIM-swapping attack targeting the phone number of the person in charge of the X account.

This allowed the defendant to gain control over their phone number, reset the password for the account to post the fake announcement, and enable others part of the same scheme (who paid him $50,000 in Bitcoin) to access the compromised account and post the fake announcement.

"As part of the scheme, Council used an identification card printer to create a fraudulent identification card with a victim's personally identifiable information obtained from his co-conspirators," the Justice Department introduced.

"Council used the fraudulent identification card to impersonate the victim and gain access to the victim's cellular phone number for the purpose of accessing the SEC's account."

Court documents also show that Council used his personal computer to search for information related to the attack and expressed his concerns that the FBI was investigating him.

Among these searches, investigators found that the defendant was looking for details on "what are the signs that you are under investigation by law enforcement of the FBI even if you have not been contacted by them" and "how can i know for sure if I am being investigate by the FBI."

Council is scheduled to be sentenced on May 16 and faces a maximum penalty of five years in prison after pleading guilty to conspiracy to commit aggravated identity theft and access device fraud.

Die Lup-Kliniken im Landkreis Ludwigslust-Parchim sind von einem Cyberangriff betroffen. Wie der Landkreis mitteilte, sind die Klinikstandorte Hagenow......

Apple has released emergency security updates to patch a zero-day vulnerability that the enterprise says was exploited in targeted and.

Admins, die die Asset-Managementsoftware Trimble Cityworks verwalten, müssen ihre Systeme durch die Installation eines Sicherheitsupdates vor laufende......