OP-512 Uses Custom Web Shell Framework to Target IIS Servers
Summary
ReliaQuest describes OP-512 targeting a legacy IIS server with a custom three-web-shell framework. The cluster used timestomping and automated reporting; ReliaQuest assesses its China link with moderate to high confidence.
Key points
- ReliaQuest identified OP-512 as a previously unreported cluster and assesses with moderate to high confidence that its espionage-focused activity is linked to China.
- The custom framework uses three web shells for file management, authenticated command execution through two access paths, and automated reporting.
- The shells scan nearby files and match their timestamps to the median last-modified time, complicating forensic timelines.
- In the observed activity, the attacker used the IIS worker process, w3wp.exe, to place a web shell in an application upload directory; reporting used DNS or HTTP as a fallback.
- The targeted host ran Windows Server 2016 and end-of-life .NET Framework 4.0; the report also noted earlier DNS queries to ashx[.]lhlsjcb[.]com.
- OP-512 reportedly attempted to escalate privileges to SYSTEM using Potato Suite.
Article Details
- Attack Vectors
- OP-512 targeted an internet-facing Microsoft IIS server running Windows Server 2016 and end-of-life .NET Framework 4.0.
- The attacker used the IIS worker process w3wp.exe to place a web shell in the application's upload directory.
- The deployed web shells provided file management and authenticated command execution through two access paths.
- The web shells automatically reported their location to an attacker-controlled domain using DNS queries or an HTTP request as a fallback.
- Defensive Notes
- The article identifies legacy, unsupported software on internet-facing IIS servers as a preferred entry point for the described threat activity.
- The reported framework manipulates web-shell creation and modification timestamps to match the median last-modified time of nearby files; timestamp changes around web-shell placement may therefore be relevant to detection.
- The web shells use cryptographic controls to restrict access and automatically report compromised-server details, according to ReliaQuest.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ashx[.]lhlsjcb[.]com | Attacker-controlled domain that received DNS queries during prior activity on the targeted host. |
MITRE ATT&CK
T1070.006 · TimestompThe web-shell framework overwrote its creation and modification times to match the median last-modified timestamp of nearby files.T1071.001 · Web ProtocolsThe web-shell reporting mechanism could use an HTTP request as a fallback to transmit the web shell's location.T1071.004 · DNSThe compromised server used DNS queries to report web-shell location information to an attacker-controlled domain.T1505.003 · Web ShellOP-512 deployed web shells on a compromised IIS server to provide remote access, file management, and command execution.
Threat Actors
CL-STA-0048The article describes close tactical proximity to OP-512 and says CL-STA-0048 has also targeted IIS servers; it leaves open whether the clusters are connected or developed capabilities independently.DragonRankThe article identifies DragonRank as another group reported to have targeted IIS web servers during the preceding 12 months.GhostRedirectorThe article identifies GhostRedirector as another group reported to have targeted IIS web servers during the preceding 12 months.OP-512ReliaQuest links this espionage-focused cluster to China with moderate to high confidence. It reportedly targeted IIS servers and deployed a custom web-shell framework.SHADOW-EARTH-053The article says SHADOW-EARTH-053 targeted IIS servers in a China-aligned espionage campaign against government and defense sectors across South, East, and Southeast Asia.
Malware
Vendors
Products
.NET Framework 4.0The campaign targeted a legacy Windows Server 2016 IIS host with end-of-life .NET Framework 4.0.Microsoft Internet Information Services (IIS)dubbed OP-512 (where “OP” stands for “opponent”) that has been observed targeting Microsoft Internet Information Services (IIS) servers to deploy a bespoke web shell framework.Windows Server 2016The campaign targeted a legacy Windows Server 2016 IIS host with end-of-life .NET Framework 4.0.