BadIIS Malware Hijacks IIS Servers to Redirect Users to Illicit Sites

A new variant of the BadIIS malware that hijacks Microsoft IIS web servers to redirect users to illicit websites, highlighting an evolving malware-as-a-service (MaaS) ecosystem operated by Chinese-speaking cybercrime groups.

The newly analyzed variant is marked by embedded “demo.pdb” strings, which Talos used to trace its development history.

Evidence suggests the malware has been actively maintained from at least September 2021 through January 2026 by a developer using the alias “lwxat.”

Program database (PDB) paths reveal a structured and iterative development process, including rapid updates, feature branching, and targeted evasion techniques.

Some builds were specifically designed to bypass antivirus solutions such as Norton, while others introduced fixes to avoid operational errors like IIS “503 Service Unavailable” responses that could expose infections.

Talos assesses with moderate confidence that this variant is not tied to a single threat actor but is instead a shared or sold tool used by multiple groups, reinforcing its classification as commodity malware.

Cisco Talos said in a report shared with GBhackers, has uncovered a BadIIS variant identifiable by its embedded “demo.pdb” strings that functions as commodity malware. 

BadIIS primarily focuses on search engine optimization (SEO) fraud and web traffic manipulation. Once deployed on a compromised IIS server, it can:

• Redirect legitimate users to malicious destinations such as gambling or adult sites.
• Act as a reverse proxy to deliver malicious content to search engine crawlers.
• Inject spam content and manipulate site metadata (title, description, keywords).
• Insert internal and external backlinks to boost the rankings of attacker-controlled domains.

Threat actors can configure the hijacking rate (percentage of traffic affected), toggle whether the homepage is explicitly targeted, and supply a remote URL to dynamically fetch malicious title, description, and keyword (TDK) metadata. 

For example, when a search engine crawler visits a compromised site, BadIIS can silently serve different content than what normal users see, helping malicious pages rank higher in search results without immediate detection.

BadIIS Malware Hijacks IIS

Talos report is a dedicated builder tool used to generate customized BadIIS payloads. This tool allows attackers to:

• Configure redirection URLs and behavior.
• Enable reverse proxy features for crawler manipulation.
• Define content hijacking rules and traffic percentages.
• Inject backlinks and SEO spam scripts.

The builder also embeds configuration data directly into the malware and obfuscates command-and-control (C2) server addresses using a simple XOR encoding technique.

Notably, the builder includes an authentication mechanism that checks for a specific response string, “lwxat,” from the C2 server. This unique marker serves as a strong attribution clue linking multiple tools in the ecosystem.

Beyond the core malware, Talos discovered a suite of auxiliary tools developed by the same author. These include installers, droppers, and service-based components that automate deployment and ensure persistence.

Some tools operate as Windows services under names like “Winlogin,” while others use double Base64 encoding or custom obfuscation to hide their activity.

Newer versions implement a two-stage installation process, where a primary installer deploys BadIIS and a secondary component ensures it is restored even if removed.

The malware also copies itself to hidden backup locations, allowing it to survive server restarts and security remediation attempts.

Analysis of PDB paths and embedded strings points to the alias “lwxat” as the likely developer. Additional references to a customer named “xshen” suggest that customized builds are created for specific clients, supporting a commercial MaaS model.

Since 2024, Talos has observed attacks using this variant across the Asia-Pacific region, as well as in Europe, North America, and South Africa.

While other vendors such as Trend Micro, AhnLab, VNPT, and Elastic have reported similar campaigns, differences in tactics indicate multiple actors leveraging the same underlying toolset.

The continued evolution of BadIIS demonstrates how web server malware is being industrialized, enabling threat actors to monetize compromised infrastructure at scale through SEO fraud and traffic redirection.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.