A recent campaign has been observed targeting Internet Information Services (IIS) servers in Asia, primarily in countries such as India, Thailand, Vietnam, Philippines, Singapore, Taiwan, South Korea, Japan, and Brazil, with the goal of installing BadIIS malware as part of a search engine optimization (SEO) manipulation scheme. This campaign is believed to be financially motivated and involves compromising IIS servers associated with government, universities, technology companies, and telecommunications sectors, and using them to serve altered content, including redirects to illegal gambling websites, malware, or credential harvesting pages. Additionally, Microsoft has warned of a type of malware attack that involves injecting malicious code into ViewState using static ASP.NET machine keys that are readily available online, which can allow attackers to execute remote code execution (RCE) and deploy additional malicious payloads. Hackers are also actively exploiting vulnerabilities in SimpleHelp RMM clients to create administrator accounts, drop backdoors, and potentially lay the groundwork for ransomware attacks. Furthermore, cybersecurity researchers have discovered two malicious machine learning (ML) models on the Hugging Face platform that utilize a novel technique called “nullifAI” to evade detection, containing “broken” pickle files that execute malicious Python code, specifically a platform-aware reverse shell that connects to a hard-coded IP address. These incidents highlight the importance of securing applications, restricting access to trusted IP ranges, and monitoring for suspicious activity to prevent unauthorized access and potential ransomware attacks, as well as the need for developers to generate unique machine keys, encrypt sensitive data, and upgrade to ASP.NET 4.8 to enable Antimalware Scan Interface (AMSI) capabilities. CTIX analysts will continue to report on the latest malware strains and attack methodologies.