Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Gold Melody’s Hidden Chords: Initial Access Broker In-Memory IIS Modules Revealed

Summary: Unit 42 researchers documented an initial access broker tracked as TGR-CRI-0045, attributed with medium confidence to Gold Melody (aka UNC961, Prophet Spider), exploiting leaked ASP.NET Machine Keys to sign malicious View State deserialization payloads that execute in server memory. The earliest evidence of exploitation and tool deployment was October 2024, with a significant activity increase between late January and March 2025, and Unit 42 identified or responded to incidents at around a dozen organizations, mostly in the U.S. and Europe across financial services, manufacturing, wholesale and retail, high technology, and transportation and logistics.

What's compelling: In-memory IIS tradecraft leaves almost no on-disk artifacts, and remediation typically happens only when Machine Keys are regenerated or the server is decommissioned - which is how an access broker can hold long-term, low-footprint access to a pool of compromised systems and sell it on.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Data Breaches
Related