Hackers Hijacking IIS Servers in The Wild Using Exposed ASP .NET Machine Keys to Inject Malicious Modules

A global campaign is actively compromising IIS servers by abusing publicly exposed ASP.NET machine keys to deserialize viewstate and execute code, deploying a malicious IIS module (HijackServer) and a signed kernel rootkit (Wingtb.sys) to maintain persistence and evade detection; the intrusion facilitates SEO fraud and exposes an unauthenticated remote command execution backdoor, impacting roughly 240 server IPs and 280 domains across multiple sectors.