Covert Malware Operation Hijacks Windows IIS Servers Using Native Modules
An elusive cyber campaign has surfaced, compromising Windows IIS web servers through stealthy, deeply embedded native modules.
Security analysts have traced this operation to Chinese-speaking adversaries who are leveraging custom IIS malware to breach South Korean infrastructure. Once embedded, the malware grants attackers full visibility into incoming HTTP requests, enabling silent manipulation of web traffic—all while slipping past traditional detection tools.
Multi-Layered Breach Strategy Unfolds
Uncovered in February 2025, the campaign kicks off with the exploitation of misconfigured or neglected IIS servers. From there, attackers escalate their presence through a staged intrusion process:
- Stage One – A .NET-based loader is deployed as a WebShell, giving remote access and command execution capabilities.
- Stage Two – A rogue native IIS module is introduced, granting attackers durable, low-level control over the server environment.
The campaign’s sophistication lies in its use of legitimate administrative tooling. The attackers exploit Microsoft’s own AppCmd[.]exe—an official IIS configuration utility—to register the malicious module, masking its activity as routine server management:
bash
AppCmd.exe install module /name:…
This strategic misuse of trusted tools enables seamless integration and long-term persistence, marking a troubling evolution in web server compromise tactics.
Malicious IIS Module Disguised as Legitimate Server Extension Enables Stealth Control
Threat actors have engineered a deceptive maneuver that embeds a malicious dynamic-link library, caches.dll, into Windows IIS infrastructure under the alias IsapiCachesModule. Once disguised as a legitimate extension, it seamlessly integrates into 64-bit IIS worker processes (w3wp[.]exe), ensuring its activation during routine server operations.
According to analysts at AhnLab Security Intelligence Center (ASEC), the implanted module isn’t passive—it actively reshapes the server’s behavior. It injects hooks at three pivotal stages in the HTTP transaction lifecycle:
- Global Request Entry (OnGlobalPreBeginRequest) – Engages before any request routing, enabling universal interception.
- Initial Request Handling (OnBeginRequest) – Captures individual HTTP calls at the earliest opportunity.
- Response Dispatch (OnSendResponse) – Alters outgoing data just before it’s returned to the user, completing the compromise loop.
Modular Arsenal Offers Tailored Exploitation
The module houses five operational payloads, each tailored for specific exploitation tactics:
- WebdllServer – Executes arbitrary ASP code when “web.dll” is detected in URLs.
- RedirectServer – Alters destination traffic flows, directing users to attacker-controlled sites.
- AffLinkServer – Injects monetized banners via malicious tracking cookies and parameters.
- HiJackServer – Listens for covert configuration commands sent via obscure URIs.
- UploadServer – Allows secret uploading of files directly to the compromised host.
To reinforce stealth, the attackers deploy HijackDriverManager, a rootkit management utility with a Chinese-language GUI. This utility operates in tandem with Winkbj.sys, a rootkit driver that conceals files, processes, and registry keys from antivirus and endpoint monitoring tools—effectively rendering the threat invisible.
Backdoor Activity Tied to Advanced Espionage Toolkit
Analysis of the breached systems uncovered active communication with a remote host at 47.236.9[.]229:10086, traced to the well-known Gh0st RAT—a remote access Trojan frequently linked to cyber espionage units operating out of China.
Investigators point to a Chinese-speaking threat actor as the source of the campaign, citing linguistic artifacts within the tooling and the unmistakable fingerprint of Gh0st RAT. The evidence suggests a dual motive: covert data exfiltration combined with opportunistic financial exploitation.
Malicious IIS Modules Used to Inject Affiliate Links and Host Phishing Sites
According to findings shared by ASEC with Cyber Security News, attackers gained deep control of compromised IIS servers by embedding malicious modules directly into the server stack. This access allowed them to inject affiliate tracking links into outbound HTTP responses—effectively monetizing traffic hijacked from legitimate web services.
Beyond link injection, the attackers also planted phishing pages on the servers and redirected unsuspecting visitors, exposing sensitive data to exfiltration.
Defensive Recommendations for IIS Environments
To counteract this emerging class of server-side threats, administrators should take the following proactive steps:
- Deploy all available OS and IIS patches without delay to close known vulnerabilities.
- Activate behavioral detection engines capable of identifying abnormal web server operations.
- Continuously monitor for unusual use of
AppCmd[.]exe, especially related to module registration. - Audit server configurations regularly to detect unauthorized module deployments or setting changes.
- Restrict administrative privileges to essential personnel and enforce strong authentication protocols.
This incident underscores how threat actors are increasingly weaponizing legitimate admin tools to embed themselves within server infrastructure—blending in with normal operations to maintain access and avoid detection.
