Microsoft says attackers use exposed ASP.NET keys to deploy malware

Microsoft warns that attackers are using publicly disclosed ASP.NET machineKey values to create malicious ViewState payloads that bypass ViewState integrity protections, enabling remote code execution on IIS web servers; Microsoft has observed active exploitation (including delivery of a post-exploitation framework named Godzilla), identified over 3,000 publicly disclosed keys that could be abused, and recommends securely generating/rotating machine keys, encrypting secrets, upgrading to ASP.NET 4.8 for AMSI, and hardening servers.