China-Linked Espionage Cluster Deploys Custom ASPX/ASHX Shells on IIS

Gbhackers •Eswar • June 6, 2026

A previously disclosed China-linked threat cluster, tracked as OP-512, has been observed deploying a purpose-built web shell framework to compromise Internet Information Services (IIS) servers. Identified by ReliaQuest, the espionage operation targeted a Windows Server 2016 environment running an end-of-life .NET Framework 4.0. Telemetry revealed the threat actors established access 75 days prior to the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

China-linked OP-512 Threat Cluster Targets Microsoft IIS Servers The OP-512 threat cluster has been identified as actively targeting Microsoft Internet Information Services (IIS) servers, with a focus on espionage. Researchers attribute this activity to China, marking it as the fourth group to exploit IIS vulnerabilities in the past year. OP-512 employs a sophisticated web shell framework consisting of three distinct web shells, designed for remote access while avoiding detection. The group uses techniques like timestomping to manipulate file timestamps and blend in with legitimate files. Targeted systems include legacy IIS servers, such as those running Windows Server 2016 with outdated .NET Frameworks. The attack method involves dropping a web shell via the server's worker process, which reports its location to an attacker-controlled domain. Additionally, OP-512 attempts privilege escalation to the SYSTEM level using the Potato Suite. The advanced tooling suggests a deliberate design to evade defenses against known China-linked groups, creating significant challenges for defenders relying on signature-based detection. 5 sources 73

Extracted Entities

China-Linked Espionage Cluster Deploys Custom ASPX/ASHX Shells on IIS

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Countries (1)

MITRE ATT&CK (1)

Platforms (1)