Cybersecurity researchers have identified a new threat cluster known as OP-512, which has been targeting Microsoft Internet Information Services (IIS) servers using a customized web shell framework. The activity is believed to be linked to Chinese espionage efforts, according to a report by ReliaQuest.<\/p>\n
The organization noted that OP-512 appears to be conducting espionage operations by exploiting compromised IIS web servers within sectors that align with China’s intelligence goals. Although OP-512 overlaps with no previously known Chinese adversaries, it marks the fourth such group targeting IIS servers within the last year, following CL-STA-0048<\/a>, DragonRank<\/a>, and GhostRedirector<\/a>. Recent findings from Cisco Talos also highlighted the use of a specific malware variant called BadIIS by several Chinese-speaking cybercrime groups.<\/p>\n OP-512 employs a sophisticated custom web shell framework composed of three web shells that allow attackers to manage compromised servers while evading detection. This framework utilizes techniques such as timestomping, which manipulates timestamps of web shell files to mislead forensic investigations.<\/p>\n As reported, the attackers effectively scanned the environment of the web shells, overwriting creation and modification timestamps to appear as if they had been present for an extended period. This strategy enhances their ability to maintain stealth throughout the attack lifecycle.<\/p>\n The unique capabilities of OP-512 include deployment of distinct web shells that restrict access through cryptographic controls, allowing for centralized management of the infected servers. This group is said to work independently, potentially suggesting an evolution from, or relation to, CL-STA-0048.<\/p>\n A specific incident described in the report involved an attack targeting a legacy IIS server running Windows Server 2016 that used an end-of-life .NET Framework version. Prior reconnaissance activities included DNS queries to domains under the control of the attackers, indicating advanced planning before the attack commenced.<\/p>\n Once the web shells were successfully deployed, OP-512 attempted to elevate its privileges to SYSTEM level, using tools from the Potato Suite to check its system rights. The report cautioned that the emergence of four separate Chinese clusters focused on IIS technology within a year is likely not a coincidence, suggesting that these servers, particularly those running obsolete software, represent a favored entry point in broader espionage efforts.<\/p>\n Organizations that have adapted their defensive measures to counter known threats may find themselves unprepared for the distinct methods and frameworks employed by OP-512.<\/p>\n","protected":false},"excerpt":{"rendered":" Cybersecurity researchers have identified a new threat cluster known as OP-512, which has been targeting Microsoft Internet Information Services (IIS) servers using a customized web shell framework. The activity is believed to be linked to Chinese espionage efforts, according to a report by ReliaQuest. The organization noted that OP-512 appears to be conducting espionage operations […]<\/p>\n","protected":false},"author":0,"featured_media":11343,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-11342","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"_links":{"self":[{"href":"http:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts\/11342","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"http:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/comments?post=11342"}],"version-history":[{"count":0,"href":"http:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts\/11342\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/media\/11343"}],"wp:attachment":[{"href":"http:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/media?parent=11342"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/categories?post=11342"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/tags?post=11342"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}