Cybersecurity researchers have uncovered a sophisticated search engine optimization (SEO) poisoning campaign targeting East and Southeast Asia, with Vietnam being the primary focus. The operation, dubbed “Operation Rewrite,” is believed to be orchestrated by Chinese-speaking cybercriminals using advanced malware called BadIIS.
## How the Attack Works
The campaign employs a technique known as SEO poisoning, where attackers manipulate search engine results to redirect unsuspecting users to malicious websites, typically gambling or adult content sites, for financial gain. The core of this operation relies on BadIIS, a malicious Internet Information Services (IIS) module that infiltrates legitimate websites.
**The attack unfolds in three stages:**
1. **Infiltration**: BadIIS intercepts and modifies incoming web traffic on compromised servers
2. **Manipulation**: The malware injects keywords and phrases into legitimate websites with good domain reputations
3. **Redirection**: When users search for these terms and click on the compromised sites, they’re redirected to scam websites
## Technical Sophistication
The BadIIS malware demonstrates remarkable technical sophistication by identifying search engine crawlers through User-Agent headers in HTTP requests. Once detected, it contacts external command-and-control servers to fetch poisoned content, causing search engines to index the victim site for unrelated terms.
Researchers from Palo Alto Networks Unit 42 have identified multiple variants of the attack tools, including lightweight ASP.NET handlers, managed .NET IIS modules, and all-in-one PHP scripts—all designed to manipulate search results and control traffic flow.
## Attribution and Scale
The threat actor, tracked as CL-UNK-1037, shows clear connections to previously identified cybercriminal groups, including Group 9 and DragonRank. Evidence points to Chinese-speaking operators based on linguistic analysis and infrastructure patterns.
In documented cases, attackers have escalated their access beyond simple SEO manipulation, creating local user accounts, deploying web shells for persistent access, and even stealing source code from compromised systems.
## Broader Implications
This campaign represents a growing trend in cybercrime where attackers leverage legitimate infrastructure to conduct malicious activities. By using compromised websites as reverse proxies, criminals can operate with reduced detection while maximizing their reach and profitability.
The discovery follows similar findings by ESET researchers, who recently identified the GhostRedirector cluster that compromised at least 65 Windows servers across Brazil, Thailand, and Vietnam using comparable techniques.
As SEO poisoning attacks become more sophisticated, organizations must implement robust security measures to protect their web infrastructure from becoming unwitting participants in these criminal schemes.