From PDB strings to MaaS: Tracking a commodity BadIIS ecosystem used by Chinese-speaking threat

· Blog Talosintelligence · May 19, 2026, 10:22 a.m.
Threat Spotlight Cisco Talos Malware Protection Cisco Talos Antivirus Cisco Talos Web Filtering Cybersecurity MAAS malware threat-intelligence
Summary
This post discusses the discovery of a BadIIS malware variant that uses 'demo.pdb' strings and operates under a malware-as-a-service model, highlighting its use among Chinese-speaking cyber crime groups.
Read full post on blog.talosintelligence.com →
AUTHOR
BLOG POST FEATURED ON

Placeholder image
r/hackerworkspace

1 points

Placeholder image
r/blueteamsec

1 points

Add this plugin to your blog