en.Wedoany.com Reported - Cybersecurity researchers have uncovered a previously unreported threat cluster, OP-512, which targets Microsoft Internet Information Services (IIS) servers to deploy a custom Web Shell framework. Security firm ReliaQuest assesses with medium to high confidence that this espionage-focused campaign is linked to China.
In its report, ReliaQuest noted that OP-512 is highly likely conducting espionage against organizations via compromised IIS Web servers, with the targeted organizations' industries and geographic locations aligning with China's intelligence priorities. Although no overlap has been found between OP-512 and other known China-linked adversaries, it is the fourth threat group specifically targeting IIS Web servers in the past 12 months, following CL-STA-0048, DragonRank, and GhostRedirector. Just last month, Cisco Talos disclosed that multiple Chinese cybercriminal groups share a malware variant called BadIIS to infect IIS servers. IIS servers have also become a target of SHADOW-EARTH-053 as part of a new China-linked espionage campaign targeting government and defense sectors in South Asia, East Asia, and Southeast Asia.
At the core of the OP-512 operation is a custom Web Shell framework comprising three Web Shells, enabling attackers to remotely access compromised hosts while taking measures to evade signature-based detection and deliberately manipulate timestamps during the creation or modification of Web Shell artifacts through techniques such as timestomping, thereby complicating forensic timelines. Specifically, attackers scan every file and subfolder around the Web Shell's location, calculate the median latest modification timestamp, and overwrite their own creation and modification times to match that value, creating the impression that the Web Shell has existed for some time.
ReliaQuest stated that the framework combines capabilities rarely seen together: each deployment is uniquely generated, attacker access is restricted through encrypted controls, and compromised servers automatically report back for large-scale centralized management. OP-512 is tactically very close to CL-STA-0048 and may represent an existing cluster that has completely overhauled its toolset, or a group that independently developed these capabilities. Regardless of its origin, this hacking group operates as a distinct cluster with an autonomous approach.
In observed attacks, the threat actors targeted an outdated IIS server running Windows Server 2016 with the unsupported .NET Framework 4.0. Evidence suggests that the same host had activity approximately 75 days before the main incident, involving DNS queries to the attacker-controlled domain "ashx.lhlsjcb[.]com." A series of actions occurring weeks later were described as a "sprint," where attackers used the Web server's worker process ("w3wp.exe") to place one of the Web Shells into the application's upload directory, triggering a self-reporting mechanism that transmitted the Web Shell's location to the attacker-controlled domain via DNS queries or HTTP requests.
The three Web Shells collectively provide attackers with file management, command execution authenticated through two independent access paths, and automatic reporting of compromised status. After deploying the Web Shells, OP-512 attempted to escalate privileges to the SYSTEM level using the Potato Suite, subsequently running commands such as "whoami /priv" to confirm system privileges.
ReliaQuest noted that it is unlikely a coincidence that four China-linked clusters have targeted the same technology in less than a year. Internet-facing IIS servers running outdated, unsupported software remain a popular entry point in this threat ecosystem, with no signs of slowing down. What defenders should worry about most is what sets OP-512 apart: instead of using common tools and reusing them across multiple campaigns, this threat cluster employs a purpose-built framework designed to defeat detection methods effective against the other three clusters. Organizations that have tailored their defenses based on known actors are likely not adequately covered.
This article is compiled by Wedoany. All AI citations must indicate the source as "Wedoany". If there is any infringement or other issues, please notify us promptly, and we will modify or delete it accordingly. Email: news@wedoany.com
