By rssfeeds-admin 
A newly identified China-linked threat cluster, dubbed OP-512, is targeting Internet Information Services (IIS) servers using a highly evasive custom web shell framework.
Discovered by ReliaQuest, this espionage operation stands out in an increasingly crowded attack surface.
OP-512 marks at least the fourth China-aligned group to compromise IIS servers in the past year, but its sophisticated tooling easily bypasses standard endpoint defenses.
The attackers breached a legacy Windows Server 2016 system running an unsupported .NET Framework 4.0, maintaining quiet access for 75 days before rapidly deploying their custom framework.
OP-512 shares narrow tactical overlaps with other China-linked operations, specifically the CL-STA-0048 group. Both operations use rare hex-encoded domain name system (DNS) subdomains for covert signaling.
However, OP-512’s heavy investment in custom, cryptographically locked tooling suggests it is a completely distinct, highly capable cluster operating independently.
OP-512 Targets IIS Servers
At the core of OP-512’s operation is a unique web shell framework consisting of three distinct files. The first is an .aspx file manager that immediately reports its successful deployment back to the attackers.
It does this by automatically transmitting its own URL through a hex-encoded DNS query. If the DNS query fails, it uses a standard HTTP request as a fallback command-and-control channel.
This self-reporting mechanism means attackers can drop the file and let their infrastructure automatically catalog its location.
The other two files are .ashx cryptographic command handlers that grant the attackers secure remote access. These handlers represent a significant leap in operational security.
Each deployment is generated uniquely by an automated builder, ensuring distinct file hashes for every target. Access is strictly gated by RSA signature verification and RC4 encryption.
Without the exact RSA private key, absolutely no one can issue commands to the server.
To further blend in, all three web shells utilize advanced timestomping techniques to hide in plain sight. The malware scans the files in the current directory to calculate the median modification date.
IIS is designed to restart worker processes when they crash automatically. Because the host was not fully isolated, the attacker’s tooling simply reloaded into memory within minutes of being killed by the security software, ReliaQuest said.
Removing the initial web shells is also not enough to stop this persistent threat. When IIS processes .aspx or .ashx files, the .NET runtime automatically generates compiled dynamic link library (DLL) files in a temporary directory.
Indicators of Compromise
| Artifact | Details |
|---|---|
ashx.lhlsjcb[.]com | DNS C2 domain observed during earlier activity on the same host, approximately 75 days before the primary incident. The use of a different domain from the later intrusion suggests infrastructure rotation between visits. |
hcgos[.]com | DNS C2 domain used by the self-reporting notification channel. In logs, look for the subdomain pattern a.<hex>.c.hcgos[.]com. |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
The post China-Linked OP-512 Targets IIS Servers With Unique Web Shell Framework appeared first on Cyber Security News.
Discover more from RSS Feeds Cloud
Subscribe to get the latest posts sent to your email.