# BADIIS to the Bone: New Insights to a Global SEO Poisoning Campaign

Chinese-speaking REF4033 group compromised 1,800+ IIS servers with BADIIS native module, cloaking SEO-poisoned pages to crawlers and redirecting users to gambling and crypto-phishing sites.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft
- Analysis by: Jia Yu Chan, Daniel Stepanic, Cyril François
- Disclosed: 2026-02-11
- Write-up quality: 7/10
- Original: https://www.elastic.co/security-labs/threat-command/badiis-to-the-bone-new-insights-to-global-seo-poisoning-campaign
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-badiis-to-the-bone-new-insights-to-global-seo-poisoning-campaign
- Tags: area:web domain:web impact:data-leak impact:integrity kind:incident platform:threat-intel sev:high tech:windows technique:reverse-engineering technique:source-review vuln:misconfiguration

**Target:** Windows IIS web servers (w3wp.exe worker process, DefaultAppPool config)
**Root cause:** Attackers with admin access install a malicious native IIS module (WsmRes32/64.dll) into globalModules/modules of DefaultAppPool.config, which hooks the request pipeline first and last to conditionally inject SEO backlinks or redirect based on User-Agent/Referer.
**Steps:**
1. Gain admin on IIS host (vector unknown); enumerate via webshell under w3wp.exe and create local admin account.
2. Create service `WalletServiceinfo` loading unsigned ServiceDLL `C:\ProgramData\Microsoft\Windows\Ringtones\CbsMsgApi.dll`; harden with `sc sdset "WalletServiceInfo" "D:(D;;DCLCWPDTSD;;;IU)..."`.
3. ServiceDLL copies masqueraded files from `C:\Windows\System32\drivers\WppRecorderrt.sys`/`WppRecorderpo.sys`/`WUDFPfprot.sys` into `C:\Windows\Microsoft.NET\Framework\WsmRes64.dll`.
4. Parse `DefaultAppPool.config`, append `<add name="WsmRes64" image="C:\Windows\Microsoft.NET\Framework\WsmRes64.dll" preCondition="bitness64" />` to `<globalModules>` and `<add name="WsmRes64" preCondition="bitness64" />` to `<modules>`.
5. Module decrypts config URLs (SM4-ECB key `1111111122222222`) and fetches `*fmlip.txt`, `*fmltz.txt`, `*fmllj.txt`, `*fmldz.txt` per country code.
6. On crawler UA/Referer (Googlebot, bingbot, Yeti, Daum), inject backlinks after `<body>`/`<html>`; on 404 with matching UA return 200 SEO page via `index.php?domain=<host>&uri=<original_link>`; on 404 with matching Referer serve JS redirect landing page using link from `*fmltz.txt`.
**How found:** Elastic observed an intrusion in Nov 2025 on a Southeast Asian IIS server; Defend alerts on new service WalletServiceInfo and unsigned ServiceDLL led to loader analysis. Pivoted via imphash `1e4b23eee1b96b0cc705da1e7fb9e2f3` and filename `CbsMsgApi.dll` on VirusTotal, found an older non-VMProtect sample to reverse the full chain.
**Exploitation:** Compromised high-reputation government/education/corporate domains are used to farm SEO backlinks and cloak content: crawlers see keyword-stuffed pages and link farms, while human visitors arriving from search engines get redirected to gambling, porn, and a fake Upbit staking site (uupbit[.]top) for monetization. Optional mobile-UA and server-IP subnet filtering (google.css) controls who sees redirects.
**Escalation:** Link-farming across 1,800+ interlinked infected domains amplifies search ranking manipulation; geotargeted config subdomains (kr/vn/cn/bd/jp/br/in/pk) tailor redirects per victim region.
**Insight:** Hunt IIS compromises by diffing DefaultAppPool.config globalModules against known DLLs and watching for unsigned ServiceDLLs in svchost; malware authors reuse filenames/imphashes across campaigns, so VT pivots on those reveal older unprotected samples when current ones are VMProtect-packed.

## Proof of concept (copied exactly from the original report)

**sc sdset command hardening WalletServiceInfo service ACL**

```
sc sdset "WalletServiceInfo" "D:(D;;DCLCWPDTSD;;;IU)(D;;DCLCWPDTSD;;;SU)(D;;DCLCWPDTSD;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
```

**IIS globalModules config injecting WsmRes64 BADIIS module**

```
<globalModules>
 <add name="WsmRes64" image="C:\Windows\Microsoft.NET\Framework\WsmRes64.dll" preCondition="bitness64" />
</globalModules>
<modules>
 <add name="WsmRes64" preCondition="bitness64" />
</modules>
```

**SM4 ECB decryption key for config URLs**

```
decrypted using the SM4 algorithm (a Chinese national standard block cipher) in ECB mode with the key “1111111122222222”. In older samples, the AES-128 ECB algorithm was used instead.
```