China-Linked OP-512 Targets IIS Servers With Unique Web Shell Framework

Key Takeaways

• A new, sophisticated threat group, OP-512, with suspected ties to China, is actively targeting Microsoft IIS web servers.
• The group utilizes a custom-built, cryptographically unique web shell framework designed to evade traditional signature-based detection.
• Initial server access was observed 75 days before the primary intrusion, demonstrating a patient, state-sponsored modus operandi.
• Targeted servers often run outdated Windows Server 2016 and end-of-life .NET Framework versions, highlighting the risk of legacy infrastructure.
• Despite endpoint protection terminating malicious processes, IIS’s auto-restart functionality allowed the attack to persist, underscoring the need for host isolation.

China-Linked OP-512 Targets IIS Servers with Unique Web Shell Framework

A newly identified and highly evasive threat cluster, dubbed OP-512, believed to originate from China, has been observed actively compromising Internet Information Services (IIS) web servers. This group employs a bespoke web shell framework, expertly engineered to bypass common detection mechanisms used against similar China-linked adversaries. This discovery represents a significant escalation in state-aligned espionage campaigns targeting vulnerable, often legacy, server infrastructure.

A particularly alarming characteristic of OP-512 is its methodical patience. Investigators uncovered evidence of the attackers first gaining access to a target server a full 75 days prior to the main intrusion being detected. Rather than immediately launching a full-scale assault and risking early discovery, the actor maintained a low profile, only to return much later to deploy its complete set of tools within hours—a signature tactic often associated with state-sponsored espionage operations.

Discovery and Attribution

Analysts at ReliaQuest brought this new threat cluster to light. Their advanced Agentic AI system played a crucial role, correlating numerous seemingly disparate suspicious events into a cohesive, high-priority incident. Subsequent review and validation by threat research experts confirmed the findings. The targeted organization’s industry sector and geographical location aligned with known Chinese intelligence objectives, further strengthening the attribution. According to a report shared with Cyber Security News (CSN), ReliaQuest assessed with moderate-to-high confidence that OP-512 is a previously undocumented threat actor.

The Cryptographically Unique Web Shell Framework

The core of OP-512’s operation revolves around a custom web shell framework comprising three malicious files that facilitate remote access via a web browser. A critical feature of this framework is its cryptographic uniqueness with each deployment. This means that every installation generates a distinct file fingerprint, rendering traditional signature-based detection tools largely ineffective and circumventing many common defensive measures.

The compromised server in question was running Windows Server 2016 with a .NET Framework version that had not received security updates since 2016. This incident reinforces a troubling trend: OP-512 marks at least the fourth China-linked cluster documented within the past year to specifically target legacy IIS servers, underscoring that outdated, internet-facing infrastructure remains a primary vector for espionage activities.

Infiltration and Command-and-Control

Upon initial compromise, OP-512 moved swiftly to establish robust control. The web server’s worker process first wrote a .aspx file manager web shell to an upload directory. This file included an integrated command-and-control (C2) notification channel. Within seconds, the web shell encoded its own URL and transmitted this location via two redundant channels: a DNS query and, as a fallback, an HTTP request to a backup server linked to known Meterpreter infrastructure.

Subsequently, two .ashx command handler files were deployed to the same directory. Each of these handlers was generated with a unique cryptographic key, ensuring that even if one was compromised, access through the other would remain secure. This sophisticated architecture allows the attacker to deploy the files and rely on the infrastructure to automatically track and report on their status, minimizing direct interaction and further reducing detection risk. The framework also incorporated timestomping techniques, manipulating file timestamps to mimic those of legitimate files already present on the server. For instance, a file planted in 2026 was made to appear as if it had existed since 2022, effectively sabotaging a standard forensic method used to identify recently introduced malicious artifacts.

Privilege Escalation and Persistent Access

With the web shells firmly established, OP-512 proceeded to load four exploitation toolkits directly into the server’s process memory, strategically avoiding any disk writes. Three of these toolkits were identified as components of the publicly available “Potato Suite,” which leverages inherent Windows services to elevate privileges from a restricted service account to full system-level control. A fourth toolkit, appearing in telemetry as “GhostKit,” currently has no public documentation, suggesting a custom or proprietary tool.

Despite endpoint protection systems repeatedly detecting and terminating the malicious process, the IIS server’s automatic worker process restart mechanism allowed the attacker’s tools to reload within minutes. This recurring cycle of prevention and re-execution highlights a critical vulnerability: merely stopping a malicious process without isolating the compromised host only delays, rather than prevents, an attacker operating through IIS.

What You Should Do

• Isolate or Retire Legacy Systems: Immediately decommission or segment any internet-facing servers running end-of-life operating systems (e.g., Windows Server 2016) or unsupported .NET Framework versions.
• Disable Script Execution: Configure web servers to disable script execution in upload directories to prevent web shell deployment.
• Monitor ASP.NET Compilation Directories: Implement robust monitoring for unexpected file creation or modification within ASP.NET compilation directories.
• Deploy Web Application Firewalls (WAFs): Utilize WAFs with rules designed to detect and block known web shell patterns and suspicious HTTP requests.
• Comprehensive Incident Response: During an incident, ensure that investigations thoroughly identify and remediate the initial point of compromise. Simply removing web shells without addressing the underlying vulnerability will not prevent re-infection. Isolate compromised hosts immediately upon detection of persistent malicious activity.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.