Malware
BadIIS
- First Reported
- Sep 10, 2024
- Latest Reported
- Sep 8, 2026
Reported Context (2)
- Its Windows post-compromise activity included the use of EfsPotato, QuasarRAT, BadIIS, ASHX web shells, Defender exclusions for IIS directories, a Google Chrome Start scheduled task, and rogue privileged accounts. Recorded Future Identifies 73 High-Impact Vulnerabilities in August, 70 Actively Exploited
- Cisco Talos is disclosing a new threat called “DragonRank” that primarily targets countries in Asia and a few in Europe, operating PlugX and BadIIS for search engine optimization (SEO) rank manipulation. DragonRank Compromises IIS Servers to Deploy PlugX and BadIIS for SEO Fraud
CVE (72)
Malware (4)
People (1)
Threat Actors (3)
MITRE ATT&CK (14)
Vendors (22)
Products (29)
Tools (15)
Industries (13)
Countries (6)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.