Beyond the SERP: when black hat SEO campaigns evolve into a multi-faceted criminal threat

Beyond the SERP: when black hat SEO campaigns evolve into a multi-faceted criminal threat

Speakers: Joey Chen, Security Researcher, Cisco Talos

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=Eb76Qx_OFrk

Overview

In this insightful talk from Virus Bulletin, Cisco Talos security researcher Joey Chen unravels the alarming evolution of black hat SEO campaigns, demonstrating how they have transcended mere search engine manipulation to become sophisticated, multi-faceted criminal enterprises. Chen highlights a critical shift: what were once considered low-level spam operations are now employing advanced tactics commonly associated with Advanced Persistent Threats (APTs), including lateral movement, privilege escalation, and persistent access. This presentation details the operations of two distinct threat groups, Dragon Rank and UAT 1899, showcasing their technical prowess and the intricate underground ecosystem that supports their illicit activities.

The talk underscores the increasing professionalization and globalization of cybercrime, revealing how these groups not only hijack search engine rankings for scam or gambling sites but also engage in data exfiltration and build "as-a-service" models. Chen's research provides a stark warning to defenders: the adversaries in the black hat SEO space are no longer unsophisticated actors. Their adaptive strategies, focus on long-term stealth, and ability to leverage compromised infrastructure for diverse criminal objectives demand a more robust and comprehensive defensive posture, blurring the lines between traditional cybercrime and nation-state-level threats.

Background

▶ Watch: Introduction to black hat SEO manipulation (0:00)

Black hat SEO manipulation refers to the use of unethical and often illicit methods to artificially inflate a website's ranking in search engine results, violating guidelines set by engines like Google. Historically, these tactics included keyword stuffing (overloading web pages with keywords to boost relevance) and external link farming (creating networks of compromised or low-quality sites to generate backlinks). The core principle remains the same: a higher number of backlinks from reputable or numerous sources is perceived by search engine algorithms as an indicator of a site's authority and relevance, leading to improved search engine visibility. While algorithms like Penguin and Spam Brain have been developed to detect and penalize low-quality backlinks and manipulative practices, threat actors continuously adapt, finding new ways to exploit these systems.

The problem persists because the financial incentives are substantial. Higher search rankings translate directly to increased traffic, which can then be monetized through advertisements, scam operations, illegal gambling sites, or the sale of compromised accounts and data. Attackers achieve this by compromising a vast number of Internet Information Services (IIS) servers across the internet. They install malicious programs or inject JavaScript that redirects users searching for specific keywords to their fraudulent sites. What makes these attacks particularly insidious is their stealth: the manipulations primarily affect search engine results, not directly infecting the IIS machine or its legitimate websites. A regular user browsing a legitimate site will see nothing amiss; only when they perform a search and click on a compromised link do they get redirected to malicious content, often gambling or unauthorized advertisement sites, based on their geographic region. This stealth makes detection difficult for both users and site administrators, who often remain unaware their servers are part of a larger black hat SEO network.

Key Findings

▶ Watch: Dragon Rank's three-stage attack process (7:55)

Joey Chen's presentation unveils several critical findings regarding the evolution of black hat SEO into a sophisticated, multi-faceted criminal threat. The research identifies two distinct and highly organized threat groups, Dragon Rank and UAT 1899, which exemplify this shift.

Firstly, the talk established that these are no longer rudimentary SEO fraud groups. They have adopted Advanced Persistent Threat (APT)-like tactics, including advanced lateral movement, privilege escalation, and sophisticated persistence mechanisms. Dragon Rank, for instance, exhibits expertise in exploiting vulnerabilities, deploying web shells, and establishing long-term control over compromised servers, often targeting industries typically deemed "less attractive" by traditional APTs, such as fundraising or jewelry organizations. Their operations blend the technical sophistication of state-sponsored actors with the profit-driven motives of cybercriminals.

Secondly, the research highlights a significant expansion in the scope of these campaigns. While SEO fraud remains a primary objective, groups like UAT 1899 are actively engaged in data exfiltration. They target high-value IIS servers, not just for their SEO reputation, but also to steal sensitive data such as certificate files, server configurations (e.g., AWS credentials), and various other credential data. This dual objective transforms them from mere traffic manipulators into serious data theft threats, suggesting a diversified revenue stream in underground markets.

Thirdly, the talk detailed the emergence of a highly organized SEO fraud ecosystem. This ecosystem comprises distinct roles: freelancers (small teams with technical expertise in compromising servers and deploying malware), middlemen (global teams that aggregate and sell SEO traffic or server access from freelancers to buyers), and dealers (end-buyers, often from online gaming or promotion industries, who seek to boost their visibility). This structured business model, often transacting in cryptocurrencies like USDT and USDC, facilitates large-scale operations and allows for highly customized services, targeting specific languages, regions, and audiences globally. The "middleman" role is particularly crucial, acting as a trusted broker in an otherwise low-trust environment.

Finally, the research emphasizes the globalization of these operations. Attackers are not limited by regional boundaries; their advertisement campaigns and target audiences span over 200 countries, showcasing a mature, international business model. This global reach, combined with advanced technical capabilities and a structured underground market, signifies a significant escalation in the threat posed by black hat SEO campaigns.

Technical Deep Dive

▶ Watch: UAT 1899's low-detection malware and self-defense (14:40)

The technical sophistication of Dragon Rank and UAT 1899 marks a significant departure from traditional black hat SEO. Both groups leverage multi-stage attack chains, employing a range of tools and techniques to achieve their objectives.

Dragon Rank's Attack Process can be broadly divided into three stages:

1. Initial Compromise and Web Shell Deployment: Dragon Rank typically begins by exploiting vulnerabilities in common Content Management System (CMS) applications such as WordPress and Joomla. Once a vulnerability is successfully exploited, they deploy web shells onto the victim's server. These web shells provide remote access and control, serving as their initial foothold.
2. Privilege Escalation and Backdoor Installation: After gaining initial access, the group focuses on elevating privileges on the compromised machine. This is crucial for gaining broader control and installing persistent backdoors. They aim to obtain administrative permissions, often using privilege escalation tools. Beyond machine-level access, they also seek access to the entire intranet. Their toolkit includes installing various backdoors and malware, such as Plugex modules, AnyDesk for remote control, and even Metasploit payloads like Meterpreter for advanced post-exploitation.
3. Lateral Movement and Persistence: In the third stage, Dragon Rank demonstrates advanced lateral movement capabilities. They scan the intranet for other external-facing web servers with good internet connectivity. Upon identifying suitable targets, they repeat the privilege escalation and backdoor deployment process, replicating administrator accounts to control multiple machines. A notable aspect of Dragon Rank's persistence strategy was observed when security products removed their malware. The attackers returned, using different tools (e.g., Metasploit/Meterpreter as a backdoor) to re-establish control and reinstall their "badass" SEO modules, ensuring long-term traffic generation. This adaptive persistence highlights their dedication to maintaining access.

UAT 1899's Attack Chain is even more intricate, focusing on high-value targets and comprehensive data exfiltration alongside SEO fraud:

1. Targeting and Initial Reconnaissance: UAT 1899 targets specific regions and high-value IIS servers—those with a strong online reputation beneficial for SEO manipulation. After successfully uploading a web shell, they conduct basic discovery to gather information about the server's environment.
2. Privilege Escalation and Custom Malware Deployment: Following initial access, UAT 1899 escalates privileges. A key innovation here is their custom-developed "badass" module, a new malware variant with an exceptionally low detection rate (reportedly lower than 6%). This module is designed for SEO fraud and features a well-structured architecture with clear debugging strings. Its functions include:

• fitting CNC HTML: Allows web crawlers to receive a replaced response, facilitating SEO fraud.
• proxy functions: Utilizes the compromised IIS server as a proxy to redirect connections to other Command and Control (C2) servers or malicious websites.
• inject JavaScript functions: Retrieves malicious JavaScript from a C2 server and injects it into user search browsers, forcing redirects to malicious websites.

Notably, UAT 1899 also installs IIS security tools or Web Application Firewalls (WAFs) on the compromised servers. This seemingly counter-intuitive action serves to protect their own "badass" module from other threat actors or legitimate security scans, maintaining their exclusive control and traffic generation.

1. RDP Setup and Data Infiltration: The group establishes Remote Desktop Protocol (RDP) access, first evaluating guest user accounts, then creating additional administrative accounts. They deploy tunneling tools like SoftEther, EasyTerror, or FRP to build an intranet network for RDP connections, often using scripts to automate configuration. A significant aspect of this stage is data infiltration. UAT 1899 uses file search tools, specifically mentioning a tool called "Everything," to locate high-value data. This includes certificate files, sensitive server configuration files (e.g., AWS credentials), and various other credential data. They also extract database update logs, indicating an interest in server operational details rather than just raw database files. This data is likely sold on underground markets.
2. Long-Term Persistence with Cobalt Strike: To ensure long-term stealth and control, UAT 1899 installs a heavily encrypted and obfuscated Cobalt Strike beacon. This implementation leverages a user-defined reflective loader for enhanced evasion. The Cobalt Strike instance is co-opted with script files and set up as a high-privilege scheduled task, allowing it to run persistently and stealthily, further solidifying their control over the compromised infrastructure.

Both groups demonstrate a high level of technical proficiency, moving beyond simple malware deployment to sophisticated network penetration, privilege management, and advanced evasion techniques, blurring the lines between typical cybercrime and state-sponsored operations.

Demo / Proof of Concept

▶ Watch: Middleman's crucial role and services in the ecosystem (26:30)

While the talk did not feature a live, interactive demonstration by the speaker, the detailed technical deep dive effectively served as a proof of concept for the attackers' methodologies and tools. Joey Chen meticulously described how the threat actors, particularly UAT 1899, built and deployed their custom "badass" module and how its various functions operated in practice.

For instance, the explanation of the "badass" module's three core functions—fitting CNC HTML, proxy functions, and inject JavaScript functions—outlined the precise technical mechanisms used to achieve SEO fraud and user redirection. Chen elaborated on how fitting CNC HTML allows web crawlers to receive manipulated content, directly demonstrating the core SEO manipulation. The description of JavaScript injection into user browsers illustrates the client-side redirection technique, while the proxy functions highlight the use of compromised servers as relays for malicious traffic.

Furthermore, the discussion around UAT 1899's self-defense mechanisms, such as installing IIS security tools or WAFs on compromised servers, showcased a novel approach to securing their own illicit infrastructure. This detail, along with the use of specific tunneling tools like SoftEther, EasyTerror, and FRP for RDP connections, and the "Everything" tool for data exfiltration, provided concrete examples of the attackers' operational capabilities and the practical application of their TTPs. These descriptions, backed by observation of detection timelines and malware analysis, allowed the audience to understand the functional proof of concept of these advanced black hat SEO operations.

Defensive Implications

▶ Watch: Key mitigations and the future of SEO fraud (27:50)

The evolution of black hat SEO campaigns into sophisticated, multi-faceted criminal threats demands a significant re-evaluation of defensive strategies. Organizations must recognize that these adversaries are no longer unsophisticated spammers but rather highly capable actors employing APT-like tactics.

1. Enhanced Threat Awareness: Defenders must be acutely aware that compromise by black hat SEO groups can extend far beyond simple website defacement or traffic redirection. These groups are now engaged in lateral movement, privilege escalation, and data exfiltration, making them a threat comparable to traditional cybercrime or even state-sponsored actors. The blurred lines between these threat categories necessitate a holistic security approach.
2. Proactive Vulnerability Management: Given the initial compromise vectors often involve exploiting vulnerabilities in common CMS applications like WordPress and Joomla, rigorous and timely patching is paramount. Regular security audits of web applications and underlying server infrastructure are essential to prevent the initial foothold.
3. Advanced Detection and Incident Response: Traditional anti-malware solutions may not suffice. The "badass" module with its low detection rate (less than 6%) and the use of obfuscated Cobalt Strike beacons demand advanced Endpoint Detection and Response (EDR) and Network Detection and Response (NDR) capabilities. Defenders must look for indicators of compromise related to:

• Suspicious web shell activity.
• Unusual privilege escalation attempts.
• Installation of remote access tools (e.g., AnyDesk) or tunneling software (e.g., SoftEther, EasyTerror, FRP).
• Scheduled tasks that launch highly obfuscated executables.
• Unauthorized modifications to IIS configurations or the installation of unexpected IIS security tools (which could be the attackers' self-defense).
• The presence of the "Everything" tool or similar file search utilities.
• Unusual outbound connections, especially to known C2 infrastructure.

1. Aggressive Remediation and Collaboration: If "badass" malware or similar SEO fraud components are detected, immediate and thorough eradication is crucial. As Joey Chen emphasized, deleting these modules not only secures the compromised server but also significantly disrupts the broader SEO fraud ecosystem. Collaboration with Internet Service Providers (ISPs), CERTs, and other security organizations for intelligence sharing and coordinated takedown efforts (especially targeting the "middlemen" who play a crucial role in the ecosystem) is vital to dismantle these criminal networks.
2. Robust Identity and Access Management (IAM): Implementing least privilege principles and multi-factor authentication (MFA) for all administrative accounts is critical. Monitoring for the creation of new, unauthorized user accounts or the replication of administrator accounts (a tactic used by Dragon Rank) can help detect lateral movement.
3. Data Loss Prevention (DLP) and Data Security: Given the focus on data exfiltration (certificates, server configurations, AWS credentials, database logs), organizations must deploy robust DLP solutions and implement strong data encryption practices. Monitoring for unusual file access patterns or large data transfers from sensitive directories is essential.
4. Continuous Monitoring and Threat Hunting: The adaptive nature of these groups means that static defenses are insufficient. Organizations should implement continuous monitoring, log analysis, and proactive threat hunting to identify subtle indicators of compromise that might bypass automated defenses. This includes analyzing web server logs for suspicious referrer fields or user agent strings used by the "badass" modules.

By adopting these comprehensive defensive measures, organizations can better protect themselves against the evolving and increasingly sophisticated threat posed by modern black hat SEO campaigns.

Key Takeaways

• Black hat SEO has evolved into sophisticated, multi-faceted cybercrime: No longer simple spam, these operations employ APT-like tactics including lateral movement, privilege escalation, and data exfiltration, blurring the lines between cybercrime and nation-state threats.
• Highly organized threat groups leverage advanced TTPs: Groups like Dragon Rank and UAT 1899 demonstrate advanced skills in exploiting vulnerabilities (WordPress, Joomla), deploying custom low-detection malware (the "badass" module with <6% detection), and establishing long-term persistence (obfuscated Cobalt Strike, re-installation after detection).
• A global, structured underground ecosystem fuels these operations: The ecosystem comprises freelancers, middlemen, and dealers, facilitating the trade of compromised server access, SEO traffic, and stolen data, often transacting in cryptocurrencies like USDT and USDC. Middlemen play a critical role in aggregating services and marketing globally.
• Data exfiltration is a growing objective alongside SEO fraud: Beyond manipulating search rankings, groups like UAT 1899 actively infiltrate servers to steal high-value data, including certificates, server configurations (e.g., AWS credentials), and database logs, indicating diversified revenue streams.
• Defenders must adopt advanced detection and response strategies: Traditional security measures are insufficient. Organizations need robust vulnerability management, EDR/NDR, aggressive remediation, and proactive threat hunting to counter sophisticated evasion techniques and lateral movement.
• Disrupting the ecosystem requires collaborative action: Takedown efforts should target not just the malware but also the "middlemen" who enable the business model, along with robust intelligence sharing among security organizations.

About the Speaker(s)

Joey Chen is a Security Researcher at Cisco Talos, a leading threat intelligence organization. Based in Taiwan, his research focuses on a broad range of cybersecurity domains, including APT investigations, cybercrime investigations, incident response, malware analysis, and cryptography analysis. Chen is actively involved in tracking and analyzing emerging threats, as evidenced by his detailed research into the evolving landscape of black hat SEO campaigns. He is also active on platforms like Twitter and LinkedIn, where he shares insights and findings from his work.