DragonRank Launches Black Hat SEO Campaign Targeting IIS Servers in Asia and Europe
A Chinese-speaking threat actor, codenamed DragonRank, has been linked to a new black hat SEO campaign targeting Internet Information Services (IIS) servers across Asia and Europe, aiming to manipulate search engine rankings for malicious purposes. Cisco Talos uncovered this campaign, which affects sectors including media, healthcare, manufacturing, IT services, and more, in countries like Thailand, India, Korea, Belgium, and China.
- Exploitation of IIS Servers: DragonRank exploits security vulnerabilities in web applications such as phpMyAdmin and WordPress, deploying the ASPXspy web shell to compromise IIS servers hosting corporate websites. The malware enables the attackers to launch further malicious tools like PlugX and BadIIS.
- BadIIS Malware Deployment: The BadIIS malware repurposes compromised servers as proxies for black hat SEO activities, manipulating search engine algorithms to artificially boost the ranking of fraudulent or malicious websites.
- SEO Fraud Scheme: DragonRank alters search engine algorithms to drive traffic to malicious sites, inflate or deflate competitor rankings, and enhance the visibility of scam content, such as websites promoting pornographic material.
- PlugX Backdoor and Credential Harvesting: To maintain control, DragonRank uses PlugX malware, a tool popular among Chinese threat actors, alongside credential-harvesting utilities like Mimikatz, PrintNotifyPotato, and BadPotato. This allows them to breach additional servers within the target’s network.
- Masquerading as Google Search Engine Crawler: The malware mimics the Google search engine crawler using a falsified User-Agent string, allowing it to bypass certain security measures on websites, facilitating deeper infiltration.
- Illegal Business Operations via Telegram and QQ: DragonRank offers its illicit SEO services via platforms like Telegram and QQ, providing custom promotional strategies for paying clients, who can submit keywords and websites they want to promote.
Net Protector Cyber Security continues to monitor such evolving threats and recommends businesses adopt NPAV Endpoint Security to safeguard against advanced malware like BadIIS and PlugX.
Comment(s)
Categories
- Other (42)
- Ransomware (128)
- Events and News (26)
- Features (45)
- Security (433)
- Tips (79)
- Google (22)
- Achievements (9)
- Products (33)
- Activation (7)
- Dealers (1)
- Bank Phishing (42)
- Malware Alerts (195)
- Cyber Attack (221)
- Data Backup (11)
- Data Breach (80)
- Phishing (139)
- Securty Tips (1)
- Browser Hijack (16)
- Adware (15)
- Email And Password (67)
- Android Security (56)
- Knoweldgebase (38)
- Botnet (15)
- Updates (3)
- Alert (71)
- Hacking (57)
- Social Media (7)
- vulnerability (54)
- Hacker (31)
- Spyware (8)
- Windows (6)
- Microsoft (21)
- Uber (1)
- YouTube (1)
- Trojan (2)
- Website hacks (3)
- Paytm (1)
- Credit card scam (1)
- Telegram (3)
- RAT (5)
- Bug (3)
- Twitter (2)
- Facebook (7)
- Banking Trojan (5)
- Mozilla (2)
- COVID-19 (5)
- Instagram (2)
- NPAV Announcement (5)
- IoT Security (1)
- Deals and Offers (1)
- Cloud Security (8)
- Offers (5)
- Gaming (1)
- FireFox (2)
- LinkedIn (2)
- WhatsApp (4)
- Amazon (1)
- DMart (1)
- Payment Risk (4)
- Occasion (2)
- firewall (1)
- Cloud malware (2)
- Cloud storage (2)
- Financial fraud (7)
- Impersonation phishing (1)
- DDoS (4)
- Smishing (2)
- Whale (0)
- Whale phishing (3)
- WINRAR (2)
- ZIP (2)
Recent Posts
Archive
Tags
cyber attack
phishing
data breach
ransomware
ransomeware
android malware
financial security
cyber security
malware
phishing attack
cyber threats
data stealing
phishing attacks
cyber threat
lockbit
india
data theft
ddos
financial fraud
cybercrime
cert-in
twitter
network security
phishing email
microsoft
critical vulnerability
trojan
cryptojacking
scam
phishing scam
play store
clop
email security
email phishing
vulnerability
cyber fraud
net protector total security
server security
malicious apps
winrar
data security
microsoft team
android apps
pakistan-backed hacker
cyberattack
cybercriminals
data backup
cyber attacks
organisation
ddos attack