From PDB strings to MaaS: Tracking a commodity BadIIS ecosystem used by Chinese-speaking threat

· Blog Talosintelligence · May 19, 2026, 10:22 a.m.
Threat Spotlight Cisco Talos Web Filtering Cisco Talos Antivirus Cisco Talos Malware Protection Cybersecurity malware MAAS threat-intelligence
Summary
This post discusses the discovery of a BadIIS malware variant that uses 'demo.pdb' strings and operates under a malware-as-a-service model, highlighting its use among Chinese-speaking cyber crime groups.
Read full post on blog.talosintelligence.com →
AUTHOR
Sponsored
Zulip logo Zulip
Organized team chat for people who take work seriously. Topic-based threading keeps conversations focused.
Try Zulip
Become a sponsor →
BLOG POST FEATURED ON

Placeholder image
r/hackerworkspace

1 points

Placeholder image
r/blueteamsec

1 points

Add this plugin to your blog