Source: Elastic Security Labs — Dans une analyse publiée en 2026, Elastic décrit une intrusion observée en novembre 2025 et relie cette activité au groupe REF4033 (associé à UAT-8099 selon Cisco Talos et Trend Micro), responsable d’une vaste campagne d’empoisonnement SEO s’appuyant sur le malware BADIIS installé comme module natif IIS. • Portée et objectifs: La campagne a compromis plus de 1 800 serveurs Windows IIS à travers le monde. Elle sert d’abord du HTML bourré de mots-clés aux crawlers pour poisonner les SERP, puis redirige les utilisateurs vers un écosystème de sites illicites (jeux d’argent, pornographie) et des hameçonnages crypto (ex. clone frauduleux d’Upbit). L’infrastructure est géociblée pour monétiser du trafic via des domaines gouvernementaux, éducatifs et corporatifs compromis à forte réputation. 🎯
What are the strategies for recovering from failed startup (500.30), more or less automatically in dotnet 9/10 running in IIS;
e.g. external resources or database are (temporarily) unavailable in the startup for migrations.
It seems the startup is not run again, if it failed.
(It's legacy code as well, so cannot rewrite being dependent on external in startup right now)
Is it a (powershell) script based direction - heartbeat/recycle pool; A try-catch in startup with retry/sleep?
Other?
Aus einem Ticket:
"Ich habe jetzt issreset.exe für heute Nacht eingeplant"
Na hoffentlich ist es "iisreset", nicht dass die Internationale Raumstation heute Nacht abstürzt 😊
SpaceX capsule making its fiery re-entry on the way from the #IIS to a splashdown minutes later in San Diego.
Shot (poorly) on an iPhone 17 Pro by a total amateur (me).
#space
#CheckPoint Research revealed a sophisticated wave of attacks attributed to the Chinese #threat actor #InkDragon, which targets European governments while continuing campaigns in Southeast Asia and South America. The threat actor converts compromised #IIS servers into relay nodes with #ShadowPad, exploits predictable configuration keys for access, and deploys a new #FinalDraft #backdoor for exfiltration and lateral movement.
https://research.checkpoint.com/2025/ink-dragons-relay-network-and-offensive-operation/
Key Findings Introduction Check Point Research tracks a sustained, highly capable espionage cluster, which we refer to as Ink Dragon, and is referenced in other reports as CL-STA-0049, Earth Alux, or REF7707. This cluster is assessed by several vendors to be PRC-aligned. Since at least early 2023, Ink Dragon has repeatedly targeted government, telecom, and […]
Andrew Armstrong
Anthony Powell
CyberVeille.ch
Allan Svelmøe Hansen
Markus Seifert
Scott 🇮🇱🇺🇦 WILL NOT COMPLY
Daniel Kuhl ✌🏻☮️☕️
Chema Alonso 
