Code injection attacks using publicly disclosed ASP.NET machine keys

Microsoft Threat Intelligence observed limited December 2024 activity where an attacker exploited publicly disclosed ASP.NET machine keys to perform ViewState code injection and load the Godzilla post-exploitation framework; the report explains the attack chain, lists indicators (including a Godzilla DLL SHA-256), and provides detection, hunting, and remediation guidance such as rotating/removing machineKey values and auditing configuration files.