OP-512: China-Linked Hackers Hit IIS Servers With New Tool

**OP-512:** ReliaQuest identified a previously undocumented China-linked espionage cluster that deployed cryptographically unique IIS web shells on Internet-facing, legacy .NET servers; the threat used DNS-based self-reporting (with HTTP fallback), RC4 encryption, RSA signatures, timestomping, reflective .NET assembly loading and in-memory privilege escalation tools to persist and evade signature-based detection, and defenders are advised to prioritize migration/segmentation and behavioral detection for unusual DNS patterns and reflective loading.