DragonRank Launches Black Hat SEO Campaign Targeting IIS Servers in Asia and Europe
A Chinese-speaking threat actor, codenamed DragonRank, has been linked to a new black hat SEO campaign targeting Internet Information Services (IIS) servers across Asia and Europe, aiming to manipulate search engine rankings for malicious purposes. Cisco Talos uncovered this campaign, which affects sectors including media, healthcare, manufacturing, IT services, and more, in countries like Thailand, India, Korea, Belgium, and China.
- Exploitation of IIS Servers: DragonRank exploits security vulnerabilities in web applications such as phpMyAdmin and WordPress, deploying the ASPXspy web shell to compromise IIS servers hosting corporate websites. The malware enables the attackers to launch further malicious tools like PlugX and BadIIS.
- BadIIS Malware Deployment: The BadIIS malware repurposes compromised servers as proxies for black hat SEO activities, manipulating search engine algorithms to artificially boost the ranking of fraudulent or malicious websites.
- SEO Fraud Scheme: DragonRank alters search engine algorithms to drive traffic to malicious sites, inflate or deflate competitor rankings, and enhance the visibility of scam content, such as websites promoting pornographic material.
- PlugX Backdoor and Credential Harvesting: To maintain control, DragonRank uses PlugX malware, a tool popular among Chinese threat actors, alongside credential-harvesting utilities like Mimikatz, PrintNotifyPotato, and BadPotato. This allows them to breach additional servers within the target’s network.
- Masquerading as Google Search Engine Crawler: The malware mimics the Google search engine crawler using a falsified User-Agent string, allowing it to bypass certain security measures on websites, facilitating deeper infiltration.
- Illegal Business Operations via Telegram and QQ: DragonRank offers its illicit SEO services via platforms like Telegram and QQ, providing custom promotional strategies for paying clients, who can submit keywords and websites they want to promote.
Net Protector Cyber Security continues to monitor such evolving threats and recommends businesses adopt NPAV Endpoint Security to safeguard against advanced malware like BadIIS and PlugX.
Comment(s)
Categories
- Other (42)
- Ransomware (116)
- Events and News (25)
- Features (44)
- Security (413)
- Tips (79)
- Google (22)
- Achievements (7)
- Products (31)
- Activation (7)
- Dealers (1)
- Bank Phishing (42)
- Malware Alerts (174)
- Cyber Attack (215)
- Data Backup (11)
- Data Breach (74)
- Phishing (130)
- Securty Tips (1)
- Browser Hijack (16)
- Adware (15)
- Email And Password (67)
- Android Security (53)
- Knoweldgebase (37)
- Botnet (15)
- Updates (3)
- Alert (70)
- Hacking (56)
- Social Media (7)
- vulnerability (50)
- Hacker (31)
- Spyware (8)
- Windows (5)
- Microsoft (21)
- Uber (1)
- YouTube (1)
- Trojan (2)
- Website hacks (3)
- Paytm (1)
- Credit card scam (1)
- Telegram (3)
- RAT (4)
- Bug (3)
- Twitter (2)
- Facebook (7)
- Banking Trojan (4)
- Mozilla (2)
- COVID-19 (5)
- Instagram (2)
- NPAV Announcement (5)
- IoT Security (1)
- Deals and Offers (1)
- Cloud Security (7)
- Offers (5)
- Gaming (1)
- FireFox (2)
- LinkedIn (2)
- WhatsApp (4)
- Amazon (1)
- DMart (1)
- Payment Risk (4)
- Occasion (2)
- firewall (1)
- Cloud malware (2)
- Cloud storage (2)
- Financial fraud (4)
- Impersonation phishing (1)
- DDoS (4)
- Smishing (2)
- Whale (0)
- Whale phishing (3)
- WINRAR (2)
- ZIP (1)
Recent Posts
Archive
Tags
cyber attack
phishing
data breach
ransomware
ransomeware
android malware
cyber security
data stealing
ddos
twitter
india
phishing email
microsoft
cert-in
cybercrime
malware
pune
vulnerability
cyber crime
independence day
occasion
hacking
financial security
telegram
phishing scam
android apps
financial fraud
cyber attack in india
data security
scam
clop gang
pakistani hackers
clop gang extorting
google play store
play store
fedex
user data leak
microsoft team
android
pakistan-backed hacker
whatsapp
clop
malicious apps
email phishing
december cyber attacks
lockbit
cert
cryptojacking
ddos attack
winrar