DragonRank Compromises IIS Servers to Deploy PlugX and BadIIS for SEO Fraud
Summary
Talos reports that DragonRank compromised more than 35 IIS servers across multiple countries, using web shells, credential-harvesting tools, PlugX and BadIIS to maintain access and manipulate search results toward scam sites.
Key points
- DragonRank exploited vulnerabilities in web applications such as phpMyAdmin and WordPress to gain access and deploy ASPX web shells.
- The group used compromised IIS servers for lateral movement and persistence, and ran tools including Mimikatz, BadPotato, GodPotato and PrintNotifyPotato to harvest credentials or elevate privileges.
- Talos confirmed more than 35 compromised IIS servers across countries including Thailand, India, Korea, Belgium, the Netherlands and China.
- PlugX was deployed as a backdoor; its loader used DLL sideloading and a Windows exception-handling mechanism to load the payload discreetly.
- BadIIS altered IIS responses to manipulate search-engine crawlers and direct traffic toward fraudulent sites, including scam sites using sexual-content keywords.
- Talos assessed with medium-to-high confidence that DragonRank is operated by Simplified Chinese-speaking actors and found evidence of a commercial black-hat SEO service.
- Cisco listed product detections and Snort rules for the threat; the article also provides indicators of compromise.
Article Details
- Attack Vectors
- Exploited vulnerabilities in web application services, including phpMyAdmin, WordPress, or similar applications, to gain remote code execution or file-upload capability and deploy web shells.
- Used web shells to collect system information, run credential-harvesting utilities, and deploy PlugX and BadIIS.
- Moved laterally to additional Windows IIS servers using web shells or Remote Desktop Protocol logins with acquired credentials.
- Used DLL sideloading to load PlugX; its loader also used the Windows SEH mechanism.
- Deployed BadIIS on compromised IIS servers to manipulate search-engine crawler responses, alter SEO rankings, and direct users toward scam or phishing sites.
- Defensive Notes
- The article identifies Cisco Secure Endpoint, Cisco Secure Web Appliance, Cisco Secure Email, Cisco Secure Firewall, Cisco Secure Malware Analytics, Umbrella, and Snort rules as protections or detections for this activity.
- Cisco Duo multi-factor authentication is recommended in the article to help ensure only authorized users access the network.
- The article lists Snort SIDs 63953 and 63954 and ClamAV detections associated with the threat.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | mail[.]tttseo[.]com | PlugX command-and-control address in the malware configuration. |
| DOMAIN | tttseo[.]com | DragonRank commercial website used to promote its black-hat SEO services. |
| SHA256 | 046a03725df3104d02fa33c22e919cc73bed6fd6a905098e98c07f0f1b67fadb | Hash of a PlugX loader sample identified in the analysis. |
| SHA256 | 785d92dc175cb6b7889f07aa2a65d6c99e59dc1bbc9edb8f5827668fd249fa2e | Hash of a PlugX loader sample identified in the analysis. |
| SHA256 | f748b210677a44597a724126a3d97173d97840b59d6deaf010c370657afc01f8 | Hash of a PlugX loader sample identified in the analysis. |
| URL | hxxp[:]//35[.]247[.]175[.]184:443/1[.]aspx | URL used to download a web shell onto a previously compromised IIS server. |
| URL | hxxp[:]//a[.]googie[.]pw/xx1[.]php?host=www[.][REDACTED][[.]com&reurl=/wp-content/uploads/2023/&domain=www[.][REDACTED][.]com | Example BadIIS request URL sent to its command-and-control server. |
| URL | hxxp[:]//ddos[.]tttseo[.]com/ddos/ddos[.]zip | Download URL for an archive containing PlugX loader variants. |
| URL | hxxps[:]//admin1[.]tttseo[.]com/ht[.]zip | Download URL for an archived PlugX loader and payload. |
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryTalos maps the netstat command run through the web shell to discovery of network configuration.T1021.001 · Remote Desktop ProtocolThe article maps enabling RDP on the compromised server to Remote Desktop Protocol use.T1033 · System Owner/User DiscoveryTalos maps the whoami command run through the web shell to system owner or user discovery.T1055 · Process InjectionThe PlugX loader decrypts its payload and injects it into an allocated memory block.T1057 · Process DiscoveryTalos maps the tasklist command run through the web shell to process discovery.T1069.001 · Local GroupsTalos maps the net localgroup administrators command to local group discovery.T1070 · Indicator RemovalThe article maps deletion of the admins$ account after use to indicator removal.T1082 · System Information DiscoveryTalos maps the systeminfo command run on the compromised server to system information discovery.T1098 · Account ManipulationThe article maps adding admins$ to the local administrators group to account manipulation.T1105 · Ingress Tool TransferThe article maps certutil.exe downloading 1.aspx from the listed remote address to ingress tool transfer.T1136 · Create AccountThe article maps creation of the admins$ account to account creation.T1505.003 · Web ShellDragonRank deployed ASPXSpy and other web shells on compromised web servers.T1555 · Credentials from Password StoresTalos maps execution of pp888.tmp with the whoami argument to this technique.T1574.002 · DLL Side-LoadingPlugX was loaded using DLL sideloading with a legitimate binary.
People
Threat Actors
DragonRankTalos-named activity cluster and hacking group; Talos assesses with medium to high confidence that it is operated by a Simplified Chinese-speaking actor.Group 9Talos assesses with medium confidence that the BadIIS observed in this campaign is associated with the entity called Group 9 in a Black Hat USA 2021 presentation.
Malware
BadIISCisco Talos is disclosing a new threat called “DragonRank” that primarily targets countries in Asia and a few in Europe, operating PlugX and BadIIS for search engine optimization (SEO) rank manipulation. PlugXCisco Talos is disclosing a new threat called “DragonRank” that primarily targets countries in Asia and a few in Europe, operating PlugX and BadIIS for search engine optimization (SEO) rank manipulation.
Vendors
Products
Cisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network. Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here. Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here. Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with thisCisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products. Cisco Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks. ClamAVClamAV detections are also available for this threat: Internet Information Services (IIS)Chinese-speaking hacking groups. The hacking group’s primary goal is to compromise Windows Internet Information Services (IIS) servers hosting corporate websites, with the intention of implanting the BadIIS malware.phpMyAdminDragonRank hacking group is to take advantage of vulnerabilities in web application services, such as phpMyAdmin, WordPress, or similar web applications. Once DragonRank obtains the ability to execute remote code orSnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. Snort SID for this threat is – 63953 and 63954. UmbrellaUmbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here. WordPresshacking group is to take advantage of vulnerabilities in web application services, such as phpMyAdmin, WordPress, or similar web applications. Once DragonRank obtains the ability to execute remote code or upload files
Tools
ASPXSpyand the detected location of the web shell used in this campaign, which is identified as the open-source ASPXspy web shell. BadPotatoas well as to run various credential-harvesting utilities that include Mimikatz, PrintNotifyPotato, BadPotato and GodPotato. The commands used by the attacker to gather system details and dump credentials areGodPotatoto run various credential-harvesting utilities that include Mimikatz, PrintNotifyPotato, BadPotato and GodPotato. The commands used by the attacker to gather system details and dump credentials are provided below. GodzillaThe DLL web shell has several functions embedded, Metasploit reverse shell, Godzilla web shell and ASPXSpy web shell. Below we list down the web shell file path and its compare functions. Metasploit FrameworkThrough this analysis, we discovered four distinct versions of ASP.NET compiled DLLs that embedded Metasploit and tried to connect the same C&C we found. These DLL files typically appear when ASP.NET compilesMimikatzmalware such as PlugX and BadIIS, as well as to run various credential-harvesting utilities that include Mimikatz, PrintNotifyPotato, BadPotato and GodPotato. The commands used by the attacker to gather system detailsPrintNotifyPotatoPlugX and BadIIS, as well as to run various credential-harvesting utilities that include Mimikatz, PrintNotifyPotato, BadPotato and GodPotato. The commands used by the attacker to gather system details and dumpUserCloneWin.Tool.UserClone-10034730-0
Countries
Belgiumthe BadIIS malware across a diverse array of geographic regions, including Thailand, India, Korea, Belgium, Netherlands and China in this campaign. Chinaacross a diverse array of geographic regions, including Thailand, India, Korea, Belgium, Netherlands and China in this campaign. Indiaand deployed the BadIIS malware across a diverse array of geographic regions, including Thailand, India, Korea, Belgium, Netherlands and China in this campaign. Koreaand deployed the BadIIS malware across a diverse array of geographic regions, including Thailand, India, Korea, Belgium, Netherlands and China in this campaign. Netherlandsmalware across a diverse array of geographic regions, including Thailand, India, Korea, Belgium, Netherlands and China in this campaign. Thailandbeen compromised and deployed the BadIIS malware across a diverse array of geographic regions, including Thailand, India, Korea, Belgium, Netherlands and China in this campaign.
Industries
Agriculturetransportation, religious and spiritual organizations, IT services, international affairs, agriculture, sports, and even niche markets like feng shui. This broad spectrum of targets indicates afeng shuiorganizations, IT services, international affairs, agriculture, sports, and even niche markets like feng shui. This broad spectrum of targets indicates a wide-reaching and non-targeted approach to their operations.Healthcarecast a wide net in terms of industries, encompassing sectors such as jewelry, media, research services, healthcare, video and television production, manufacturing, transportation, religious and spiritual organizations,international affairsproduction, manufacturing, transportation, religious and spiritual organizations, IT services, international affairs, agriculture, sports, and even niche markets like feng shui. This broad spectrum of targetsIT servicesvideo and television production, manufacturing, transportation, religious and spiritual organizations, IT services, international affairs, agriculture, sports, and even niche markets like feng shui. This broad spectrumjewelryNetherlands and China. They have cast a wide net in terms of industries, encompassing sectors such as jewelry, media, research services, healthcare, video and television production, manufacturing, transportation,Manufacturingsectors such as jewelry, media, research services, healthcare, video and television production, manufacturing, transportation, religious and spiritual organizations, IT services, international affairs,Mediaand China. They have cast a wide net in terms of industries, encompassing sectors such as jewelry, media, research services, healthcare, video and television production, manufacturing, transportation, religiousreligious and spiritual organizationsservices, healthcare, video and television production, manufacturing, transportation, religious and spiritual organizations, IT services, international affairs, agriculture, sports, and even niche markets like fengresearch servicesThey have cast a wide net in terms of industries, encompassing sectors such as jewelry, media, research services, healthcare, video and television production, manufacturing, transportation, religious and spiritualSportstransportation, religious and spiritual organizations, IT services, international affairs, agriculture, sports, and even niche markets like feng shui. This broad spectrum of targets indicates a wide-reaching andTransportationas jewelry, media, research services, healthcare, video and television production, manufacturing, transportation, religious and spiritual organizations, IT services, international affairs, agriculture, sports, andvideo and television productionof industries, encompassing sectors such as jewelry, media, research services, healthcare, video and television production, manufacturing, transportation, religious and spiritual organizations, IT services,