New Threat Cluster OP-512 Targets Microsoft IIS Servers with Custom Web Shell Framework

Summary: ReliaQuest discovered a previously unreported threat cluster it calls OP-512, assessed with moderate to high confidence as China-linked, targeting Microsoft IIS servers with a custom framework of three web shells that provide remote access and use timestomping to blend artifacts into surrounding files. In the observed intrusion, the actor targeted a legacy IIS server running Windows Server 2016 with end-of-life .NET Framework 4.0, dropped a web shell via w3wp.exe into the upload directory, and attempted SYSTEM-level privilege escalation with the Potato Suite.
What's compelling: OP-512 is the fourth China-linked cluster to single out IIS servers in 12 months, and ReliaQuest warns its purpose-built framework is designed to defeat the detection methods that work against the other three - so defenses tuned to known actors likely do not cover it.

Read the original at The Hacker News ↗