From PDB Strings to MaaS: Tracking a Commodity BadIIS Ecosystem

Summary

Cisco Talos identified a BadIIS malware variant marked by embedded demo.pdb strings and linked it to a malware-as-a-service ecosystem used by multiple Chinese-speaking cybercrime actors. The malware targets Microsoft IIS servers to support SEO manipulation, malicious traffic redirection, reverse proxying for search-engine crawlers, and backlink injection. Operators can customize deployments through a modular builder that supports tailored configurations, including evasion options for specific antivirus products such as Norton. Talos observed this activity worldwide from at least September 2021 through early 2026.

Investigation

Talos examined PDB paths, builder components, and authentication logic to reconstruct the malware’s development history and operational model. Researchers found that a dedicated builder creates configuration files, JavaScript redirectors, and PHP backlink payloads, while encoding command-and-control addresses with a single-byte XOR key of 0x3. The malware authenticates to its C2 by checking for the response string lwxat and uses a custom Base64 scheme for data handling. Talos also uncovered related service installers and dropper tools that shared the same code base and design patterns.

Mitigation

ClamAV and Snort provide signature-based detections for this BadIIS family. Defenders should monitor for the custom user-agent lwxatisme and the Windows service name Winlogin, as both can serve as early warning indicators. IIS hardening should include restricting installation of unapproved services, auditing IIS module registrations, and blocking outbound traffic to known malicious infrastructure. Keeping antivirus signatures up to date with the latest BadIIS variants can further reduce exposure.

Response

If BadIIS activity is discovered, responders should isolate the affected IIS server and stop the malicious Windows service. Configuration files and PDB artifacts should be collected and reviewed to determine the exact build variant in use. Associated command-and-control domains or IP addresses should be blocked, and compromised DLLs should be removed so legitimate IIS modules can be restored. Detection updates should also be shared with trusted industry peers to improve broader defensive coverage.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique designed to trigger the detection rule. The commands and narrative directly produce the telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An attacker who has gained limited user rights copies a malicious DLL bundle onto the compromised host. The bundle includes three PDB files placed in locations historically used by BadIIS samples. By creating these files, the attacker leaves a forensic artifact that the Sigma rule watches for. The attacker uses standard Copy-Item (PowerShell) to drop the files, avoiding any additional tool signatures.

• Regression Test Script:

  # BadIIS PDB Path Simulation – triggers the Sigma rule
  $paths = @(
      "C:UsersAdministratorDesktop2021-09-30x64Releasedemo.pdb",
      "C:UsersAdministratorDesktopdll-no503Releasedemo.pdb",
      "C:UsersAdministratorDesktop兼容百度浏览器+劫持robots.txtx64Releasedemo.pdb"
  )
  foreach ($p in $paths) {
      $dir = Split-Path $p -Parent
      if (-not (Test-Path $dir)) {
          New-Item -Path $dir -ItemType Directory -Force | Out-Null
      }
      New-Item -Path $p -ItemType File -Force | Out-Null
  }
  Write-Host "BadIIS PDB files created – detection should fire."

• Cleanup Commands:

  # Remove the simulated BadIIS PDB files and directories
  $paths = @(
      "C:UsersAdministratorDesktop2021-09-30",
      "C:UsersAdministratorDesktopdll-no503",
      "C:UsersAdministratorDesktop兼容百度浏览器+劫持robots.txt"
  )
  foreach ($base in $paths) {
      if (Test-Path $base) {
          Remove-Item -Path $base -Recurse -Force
      }
  }
  Write-Host "Cleanup complete."