🕵️ BadIIS

The items that name it 2

• UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
  writeup2026-08-20

  Malware deployed by UAT-10147 on IIS servers for SEO fraud

• Threat Actors Achieve Persistence After SQL Injection
  writeup2026-07-13

  Family of malicious IIS modules used for large-scale SEO fraud (traffic redirection, reverse proxy, content hijacking, internal links injection); previously documented by Cisco Talos researchers and used across multiple threat campaigns over the past year and a half. In this incident, modules HttpFa