China-Linked OP-512 Targets IIS Servers With Unique Web Shell Framework

ReliaQuest identified a suspected China-linked espionage cluster named OP-512 that sustained intermittent access to an internet-facing, end-of-life IIS/.NET server for at least 75 days and later deployed multiple custom web shells and encrypted command handlers. Each web shell is uniquely built per deployment (randomized variables, junk code, embedded RSA keys) and uses dual notification (hex-encoded DNS subdomains with HTTP fallback) to report back, while command handlers require RSA-signed and RC4-encrypted payloads. The actor timestomps files, forces ASP.NET compilation artifacts to persist, loads post-exploitation toolkits (including “Potato” escalators) reflectively in memory, and employs strong operational security, making detection reliant on behavioral telemetry and targeted mitigations such as isolating hosts, monitoring long hex-segmented DNS from w3wp.exe, and clearing ASP.NET temporary compilation artifacts.