Ankura CTIX FLASH Update - February 11, 2025

Malware Activity

Emerging Cyber Threats: Malware Campaigns and Vulnerability Exploits

A recent campaign has been observed targeting Internet Information Services (IIS) servers in Asia, primarily in countries such as India, Thailand, Vietnam, Philippines, Singapore, Taiwan, South Korea, Japan, and Brazil, with the goal of installing BadIIS malware as part of a search engine optimization (SEO) manipulation scheme. This campaign is believed to be financially motivated and involves compromising IIS servers associated with government, universities, technology companies, and telecommunications sectors, and using them to serve altered content, including redirects to illegal gambling websites, malware, or credential harvesting pages. Additionally, Microsoft has warned of a type of malware attack that involves injecting malicious code into ViewState using static ASP.NET machine keys that are readily available online, which can allow attackers to execute remote code