IIS Servers Hacked for SEO Fraud and Credential Theft

A cybercrime group is compromising high-value Internet Information Services (IIS) servers across multiple regions to conduct search engine optimization (SEO) fraud and steal sensitive data. The attackers exploit weak file upload settings to install web shells, escalate privileges, and establish persistent access using RDP and various VPN tools. Their primary goal is to deploy custom "BadIIS" malware, which manipulates search results and redirects users to malicious sites like gambling platforms. In addition to SEO manipulation, the group actively steals credentials, configuration files, and certificates from compromised organizations. For deeper persistence, the campaign also utilizes heavily obfuscated Cobalt Strike beacons deployed via DLL sideloading.