Malware

IISpy

Also known as: BadIIS

Indicators of Compromise 8

Domain vn[.]xyz Filename C:\Windows\System32\drivers\etc\hosts:cache Filename XMRig Filename acpi_pad.ko Filename demo.pdb Filename service.pdb GitHub Repo widestring-1.2.1 Registry User index.crates.io-1949cf8c6b5b557f

MITRE ATT&CK TTPs 15

T1055
Process Injection
Defense Evasion
 T1055.003
Thread Execution Hijacking
Defense Evasion
 T1059.001
PowerShell
Execution
 T1068
Exploitation for Privilege Escalation
Privilege Escalation
 T1078
Valid Accounts
Defense Evasion
 T1082
System Information Discovery
Discovery
 T1090
Proxy
Command And Control
 T1105
Ingress Tool Transfer
Command And Control
 T1110
Brute Force
Credential Access
 T1134
Access Token Manipulation
Defense Evasion
 T1203
Exploitation for Client Execution
Execution
 T1210
Exploitation of Remote Services
Lateral Movement
 T1211
Exploitation for Defense Evasion
Defense Evasion
 T1218
System Binary Proxy Execution
Defense Evasion
 T1222
File and Directory Permissions Modification
Defense Evasion

Source Articles

UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities
UAT-10147, a Chinese-speaking threat actor, is deploying a new cross-platform backdoor named SPECTRE that targets both Windows and Linux systems. The implant includes advanced capabilities such as process injection, credential theft, anti-analysis routines, and EDR evasion via Bring Your Own Vulnerable Driver (BYOVD) techniques. On Linux, SPECTRE deploys a kernel rootkit called Specter, disguised as 'acpi_pad.ko', which uses ftrace-based hooking to hide processes, modules, and enable UID 0 escalation. The actor also leverages SEO fraud tools like BadIIS and a custom ASHX web handler targeting Vietnamese users, along with multiple backdoors including Meterpreter, Noodle RAT, QuasarRAT, and Gh0stCringe for persistence.
talos ·1w ago
After the Break-In: What Attackers Do Once They're Already Inside
Huntress investigated a real-world incident in June 2026 where an attacker gained initial access via a SQL injection vulnerability on a web server. After entry, the attacker conducted reconnaissance, created a backdoor user, enabled Remote Desktop, disabled Windows Defender, and deployed multiple payloads including the BadIIS malware and the XMRig cryptocurrency miner. The attacker used PowerShell scripts to maintain persistence and evade detection, highlighting the importance of not only removing malware but also identifying and patching the initial vulnerability to prevent reinfection.
bleeping-computer ·4w ago