New Threat Cluster OP-512 Targets Microsoft IIS Servers with Custom Web Shell Framework

Chinese-linked threat cluster OP-512 deploys custom web shells on Microsoft IIS servers for espionage.

• •Three web shells enable file management, authenticated command execution, and reporting
• •Uses timestomping and cryptographic controls to evade signature-based detection
• •Targets legacy IIS servers (Windows Server 2016 with .NET Framework 4.0)
• •Fourth China-aligned group targeting IIS servers in 12 months
• •Purpose-built framework defeats detection methods against other threat actors

This summary was automatically generated by AI based on the original article and may not be fully accurate.