BADIIS Hijacks 1,800 Trusted Servers

Elastic Security Labs has uncovered a sweeping intrusion campaign in which the BADIIS malware silently compromised more than 1,800 Microsoft IIS servers worldwide. Victims include government, education and financial institutions whose trusted domains were turned into engines for global scam distribution.

The activity, linked to a Chinese-speaking cluster known as REF4033 or UAT-8099, expands on earlier findings from Cisco Talos and Trend Micro. Instead of defacing sites, operators monetised reputation by redirecting traffic toward gambling portals and cryptocurrency traps.

BADIIS is not a simple web shell. It embeds as a native IIS module, attaching to the worker process and intercepting requests before normal handling begins.

The malware inspects visitor attributes. Search crawlers receive keyword-rich pages to manipulate rankings, while real users may be invisibly pushed to fraudulent destinations. Administrators, meanwhile, are shown clean content, masking the breach.

By proxying malicious material through legitimate infrastructure, the attackers inherit the authority of respected domains, making detection far harder for both visitors and search engines.

Elastic notes heavy exposure across Asia-Pacific, but infections span multiple continents. High-credibility sites amplify scam reach, while some environments also risk theft of certificates and internal configurations.

Because BADIIS lives inside the request pipeline, traditional antivirus rarely flags it. Unsigned or unfamiliar modules can persist for long periods without triggering alarms.

Security teams should baseline approved IIS modules, enable configuration change logging and aggressively hunt unsigned libraries in system paths. Strong identity controls for administrators are critical, as module installation requires elevated rights.

This operation represents evolution—from crude spam hosting to infrastructure weaponisation. Trust itself becomes the payload.For enterprises, the warning is stark: if attackers control the server logic, brand reputation can be repurposed overnight.