The Anatomy of DragonRank: Understanding and Defending Against SEO-Driven IIS Compromises

No ratings

Presented at DeepSec 2025 by

Joey Chen

DragonRank, a sophisticated threat actor, primarily targets countries in Asia and a select few in Europe, utilizing deploy BadIIS malware across compromised IIS servers for SEO rank manipulation. In 2023, we already uncovered DragonRank’s commercial website, business model, and instant message accounts. So, what tactics did DragonRank use in these attacks, and most importantly, how can we defend against them? To answer these questions, we will first discuss how DragonRank compromised Windows IIS servers hosting corporate websites all around the world. Following that, we will discuss the advanced persistence methods employed by DragonRank including lateral movement, privilege escalation and deployment of BadIIS/PlugX in the system. Furthermore, we will explore the details of two unique real-life case studies used by the DragonRank actor from initial access to configuration IIS server to their profitable part. We will then use all the presented information to identify common flaws in the actor’s offensive strategy. In turn, finding these cases will allow us to discuss how to build an efficient defense strategy against further DragonRank attacks. We hope attendees who work in the security field will leave equipped with practical insights to develop an effective defense strategy against this threat.