A “simplified Chinese-speaking actor” has been linked to a brand new marketing campaign that has focused a number of international locations in Asia and Europe with the top purpose of performing search engine marketing (search engine optimisation) rank manipulation.
The black hat search engine optimisation cluster has been codenamed DragonRank by Cisco Talos, with victimology footprint scattered throughout Thailand, India, Korea, Belgium, the Netherlands, and China.
“DragonRank exploits targets’ web application services to deploy a web shell and utilizes it to collect system information and launch malware such as PlugX and BadIIS, running various credential-harvesting utilities,” safety researcher Joey Chen stated.
The assaults have led to compromises of 35 Web Info Companies (IIS) servers with the top purpose of deploying the BadIIS malware, which was first documented by ESET in August 2021.
It is particularly designed to facilitate proxy ware and search engine optimisation fraud by turning the compromised IIS server right into a relay level for malicious communications between its prospects (i.e., different risk actors) and their victims.
On prime of that, it could possibly modify the content material served to search engines like google and yahoo to control search engine algorithms and enhance the rating of different web sites of curiosity to the attackers.
“One of the most surprising aspects of the investigation is how versatile IIS malware is, and the [detection of] SEO fraud criminal scheme, where malware is misused to manipulate search engine algorithms and help boost the reputation of third-party websites,” safety researcher Zuzana Hromcova instructed The Hacker Information on the time.
The most recent set of assaults highlighted by Talos spans a broad spectrum of business verticals, together with jewellery, media, analysis companies, healthcare, video and tv manufacturing, manufacturing, transportation, non secular and non secular organizations, IT companies, worldwide affairs, agriculture, sports activities, and feng shui.
The assault chains start with making the most of recognized safety flaws in internet purposes like phpMyAdmin and WordPress to drop the open-source ASPXspy internet shell, which then acts as a conduit to introduce supplemental instruments into the targets’ atmosphere.
The first goal of the marketing campaign is to compromise the IIS servers internet hosting company web sites, abusing them to implant the BadIIS malware and successfully repurposing them as a launchpad for rip-off operations by using key phrases associated to porn and intercourse.
One other vital facet of the malware is its means to masquerade because the Google search engine crawler in its Consumer-Agent string when it relays the connection to the command-and-control (C2) server, thereby permitting it to bypass some web site safety measures.
“The threat actor engages in SEO manipulation by altering or exploiting search engine algorithms to improve a website’s ranking in search results,” Chen defined. “They conduct these attacks to drive traffic to malicious sites, increase the visibility of fraudulent content, or disrupt competitors by artificially inflating or deflating rankings.”
One essential approach DragonRank distinguishes itself from different black hat search engine optimisation cybercrime teams is within the method it makes an attempt to breach extra servers inside the goal’s community and preserve management over them utilizing PlugX, a backdoor extensively shared by Chinese language risk actors, and varied credential-harvesting applications reminiscent of Mimikatz, PrintNotifyPotato, BadPotato, and GodPotato.
Though the PlugX malware used within the assaults depends on DLL side-loading strategies, the loader DLL chargeable for launching the encrypted payload makes use of the Home windows Structured Exception Dealing with (SEH) mechanism in an try to make sure that the authentic file (i.e., the binary vulnerable to DLL side-loading) can load the PlugX with out tripping any alarms.
Proof unearthed by Talos factors to the risk actor sustaining a presence on Telegram underneath the deal with “tttseo” and the QQ instantaneous message software to facilitate unlawful enterprise transactions with paying purchasers.
“These adversaries also offer seemingly quality customer service, tailoring promotional plans to best fit their clients’ needs,” Chen added.
“Customers can submit the keywords and websites they wish to promote, and DragonRank develops a strategy suited to these specifications. The group also specializes in targeting promotions to specific countries and languages, ensuring a customized and comprehensive approach to online marketing.”
